Re: [PATCH v4] pci_crash: capture PCI config space at panic time

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] An out-of-bounds write corrupts the crash capture buffer if a device's cfg_size is not a 4-byte multiple.
--

--- Patch [1]: [PATCH v4] pci_crash: capture PCI config space at panic time ---
commit 453754eacce8780b38337ecf239a5ffdf63c4b25
Author: Johannes Hange <hangej@amazon.com>

pci_crash: capture PCI config space at panic time

This commit introduces a facility to capture PCI configuration space during
a kernel panic. It allocates a snapshot buffer updated via bus notifiers and
fills it using non-blocking config reads when a panic occurs. The resulting
buffer and pagemap are exported through VMCOREINFO for crash analysis.

> diff --git a/kernel/pci_crash.c b/kernel/pci_crash.c
> new file mode 100644
> --- /dev/null
> +++ b/kernel/pci_crash.c
[ ... ]
> +static void pci_crash_read_config_space(struct pci_dev *pdev, u8 *ptr,
> +					unsigned int cfg_size)
> +{
[ ... ]
> +	if (!pci_crash_endpoint_reachable(pdev)) {
> +		memset(cfg_data, 0xff, cfg_size);
> +		return;
> +	}
> +
> +	for (offset = 0; offset < cfg_size; offset += 4) {

[Severity: Medium]
Could this loop write out of bounds if cfg_size is unaligned?

Since this code executes during a panic where memory corruption is common,
pdev->cfg_size could potentially be corrupted to a value that is not a
multiple of 4. If that happens, the loop will unconditionally write 4 bytes
on its final iteration, which could overflow the allocated payload slice
for this device.

This might either corrupt the adjacent record's header or cause a double
fault if the final write crosses a vmalloc page boundary.

Would it make sense to align cfg_size down to a 4-byte boundary before
iterating, or clamp the final write to prevent it from going past the end
of the buffer?

> +		if (pci_bus_read_config_dword_trylock(pdev->bus, pdev->devfn,
> +						      offset, &val)) {
> +			put_unaligned_le32(0xFFFFFFFF, &cfg_data[offset]);
> +			continue;
> +		}
> +		put_unaligned_le32(val, &cfg_data[offset]);
> +	}
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723185216.1089927-1-hangej@amazon.com?part=1