Re: [PATCH net v2] e1000e: Fix out-of-bounds MMIO access by validating BAR0 size

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The driver unconditionally maps BAR0 with `ioremap()`, without verifying that BAR0 is an `IORESOURCE_MEM` region. A spoofed PCI device could expose BAR0 as an I/O region, which could bypass the new length check on some architectures and lead to `ioremap()` being called on an I/O port address.
--

--- Patch [1]: [PATCH net v2] e1000e: Fix out-of-bounds MMIO access by validating BAR0 size ---
commit 939eee77005bb32587689d8e06aa2cec8c38f7e9
Author: Pu Lehui <pulehui@huawei.com>

e1000e: Fix out-of-bounds MMIO access by validating BAR0 size

This commit fixes an out-of-bounds MMIO access in the e1000e driver
by ensuring the length of BAR0 is at least 64K before performing ioremap.

> diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
> index 844f31ab37ad4..46e58e926f7b4 100644
> --- a/drivers/net/ethernet/intel/e1000e/netdev.c
> +++ b/drivers/net/ethernet/intel/e1000e/netdev.c

[ ... ]

> @@ -7450,6 +7450,11 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
>  	mmio_len = pci_resource_len(pdev, 0);
>  
>  	err = -EIO;
> +	if (mmio_len < E1000_MMIO_LEN_MIN) {
> +		dev_err(&pdev->dev, "MMIO len is too small\n");
> +		goto err_ioremap;
> +	}
> +
>  	adapter->hw.hw_addr = ioremap(mmio_start, mmio_len);

[Severity: High]
This isn't a bug introduced by this patch, but is it possible for ioremap() 
to be called on an I/O port region here?

Earlier in e1000_probe(), pci_select_bars() filters out non-memory BARs. If 
a device is bound via sysfs and exposes BAR0 as an IORESOURCE_IO region 
instead of IORESOURCE_MEM, the driver fails to request the region but still 
unconditionally passes mmio_start to ioremap() at this location.

Could this cause a kernel panic on architectures where I/O space is distinct 
from memory space when the returned address is subsequently dereferenced?

>  	if (!adapter->hw.hw_addr)
>  		goto err_ioremap;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720133049.1289167-1-pulehui@huaweicloud.com?part=1