Re: [PATCH v8 22/25] PCI/sysfs: Add legacy I/O and memory attribute macros

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] An out-of-bounds heap read occurs in `pci_write_legacy_io` when a user writes 1 or 2 bytes to the `legacy_io` sysfs file.
--

commit 9cf38c5cdfc69788fc6aaf6dcdc29d5b5da5960b
Author: Krzysztof Wilczyński <kwilczynski@kernel.org>

PCI/sysfs: Add legacy I/O and memory attribute macros

Add two macros for declaring static binary attributes for PCI legacy
I/O port and ISA memory space files.

> diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
> index a861484ac0c08..7f1d8e07924f5 100644
> --- a/drivers/pci/pci-sysfs.c
> +++ b/drivers/pci/pci-sysfs.c
> @@ -893,6 +893,27 @@ pci_llseek_resource_legacy(struct file *filep,
>  }
>  
>  #ifdef HAVE_PCI_LEGACY
> +
> +#define pci_legacy_resource_io_attr(_suffix, _size)				\
> +static const struct bin_attribute pci_legacy_io##_suffix##_attr = {		\
> +	.attr = { .name = "legacy_io" __stringify(_suffix), .mode = 0600 },	\
> +	.size = (_size),							\
> +	.read = pci_read_legacy_io,						\
> +	.write = pci_write_legacy_io,						\

[Severity: High]
This isn't a bug introduced by this patch, but can the use of
pci_write_legacy_io() here trigger an out-of-bounds heap read?

When a user writes 1 or 2 bytes to a legacy_io sysfs file,
kernfs_fop_write_iter() allocates a buffer of count + 1 bytes.

In pci_write_legacy_io(), after validating count is 1, 2, or 4, the buffer is
cast and unconditionally dereferenced as a u32:

drivers/pci/pci-sysfs.c:pci_write_legacy_io() {
        /* Only support 1, 2 or 4 byte accesses */
        if (count != 1 && count != 2 && count != 4)
                return -EINVAL;

        return pci_legacy_write(bus, off, *(u32 *)buf, count);
}

Does the *(u32 *)buf dereference cause a 4-byte read from the smaller 2-byte
or 3-byte buffer, potentially triggering a KASAN slab-out-of-bounds read?

> +	.f_mapping = iomem_get_mapping,						\
> +	.llseek = pci_llseek_resource_legacy,					\
> +	.mmap = pci_mmap_legacy_io,						\
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260619085200.3729431-1-kwilczynski@kernel.org?part=22