[PATCH] PCI: Fix unmasked value in pci_generic_config_write32()

[PATCH] PCI: Fix unmasked value in pci_generic_config_write32()

[Mohamad Raizudeen]

When writing less than 4 bytes, pci_generic_config_write32() uses a
read-modify-write sequence to protect adjacent bytes. The code comment
states the goal is to "merge in the <size> bits we intend to write".

However the code does not mask the incoming 'val' before shifting it.
Since the function 'pci_generic_config_write32()' accepts a 'u32', a
caller could pass a value with extra bits set outside the intended write
size, those extra bits will shift into the adjacent bytes and corrupt them.

Fix this my masking 'val' before the shift so only the target bytes are
written. This makes the code do what the comment says and matches the
read function, pci_generic_config_read32().

Fixes: 1f94a94f67e10 ("PCI: Add generic config accessors")
Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
---
 drivers/pci/access.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/access.c b/drivers/pci/access.c
index b123da16b63b..47b38d01694c 100644
--- a/drivers/pci/access.c
+++ b/drivers/pci/access.c
@@ -176,7 +176,7 @@ int pci_generic_config_write32(struct pci_bus *bus, unsigned int devfn,
 
 	mask = ~(((1 << (size * 8)) - 1) << ((where & 0x3) * 8));
 	tmp = readl(addr) & mask;
-	tmp |= val << ((where & 0x3) * 8);
+	tmp |= (val & ((1 << (size * 8)) - 1)) << ((where & 0x3) * 8);
 	writel(tmp, addr);
 
 	return PCIBIOS_SUCCESSFUL;
-- 
2.53.0

Re: [PATCH] PCI: Fix unmasked value in pci_generic_config_write32()

[sashiko-bot]

> When writing less than 4 bytes, pci_generic_config_write32() uses a
> read-modify-write sequence to protect adjacent bytes. The code comment
> states the goal is to "merge in the <size> bits we intend to write".
> 
> However the code does not mask the incoming 'val' before shifting it.
> Since the function 'pci_generic_config_write32()' accepts a 'u32', a
> caller could pass a value with extra bits set outside the intended write
> size, those extra bits will shift into the adjacent bytes and corrupt them.
> 
> Fix this my masking 'val' before the shift so only the target bytes are
> written. This makes the code do what the comment says and matches the
> read function, pci_generic_config_read32().
> 
> Fixes: 1f94a94f67e10 ("PCI: Add generic config accessors")
> Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727080643.4949-1-raizudeen.kerneldev@gmail.com?part=1

Re: [PATCH] PCI: Fix unmasked value in pci_generic_config_write32()

[Mohamad Raizudeen]

On Mon, Jul 27, 2026 at 01:36:43PM +0530, Mohamad Raizudeen wrote:
> When writing less than 4 bytes, pci_generic_config_write32() uses a
> read-modify-write sequence to protect adjacent bytes. The code comment
> states the goal is to "merge in the <size> bits we intend to write".
> 
> However the code does not mask the incoming 'val' before shifting it.
> Since the function 'pci_generic_config_write32()' accepts a 'u32', a
> caller could pass a value with extra bits set outside the intended write
> size, those extra bits will shift into the adjacent bytes and corrupt them.
> 
> Fix this my masking 'val' before the shift so only the target bytes are
> written. This makes the code do what the comment says and matches the
> read function, pci_generic_config_read32().
> 
> Fixes: 1f94a94f67e10 ("PCI: Add generic config accessors")
> Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
> ---
>  drivers/pci/access.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/pci/access.c b/drivers/pci/access.c
> index b123da16b63b..47b38d01694c 100644
> --- a/drivers/pci/access.c
> +++ b/drivers/pci/access.c
> @@ -176,7 +176,7 @@ int pci_generic_config_write32(struct pci_bus *bus, unsigned int devfn,
>  
>  	mask = ~(((1 << (size * 8)) - 1) << ((where & 0x3) * 8));
>  	tmp = readl(addr) & mask;
> -	tmp |= val << ((where & 0x3) * 8);
> +	tmp |= (val & ((1 << (size * 8)) - 1)) << ((where & 0x3) * 8);
>  	writel(tmp, addr);
>  
>  	return PCIBIOS_SUCCESSFUL;
> -- 
> 2.53.0
>

Hi Bjorn,

Just following up on this patch. Please let me know if you have any
feedback or if further changes are needed.

Thanks & regards,
Mohamad Raizudeen

[PATCH] PCI: Fix unmasked value in pci_generic_config_write32()

[Mohamad Raizudeen]

When writing less than 4 bytes, pci_generic_config_write32() uses a
read-modify-write sequence to protect adjacent bytes. The code comment
states the goal is to "merge in the <size> bits we intend to write".

However the code does not mask the incoming 'val' before shifting it.
Since the function 'pci_generic_config_write32()' accepts a 'u32', a
caller could pass a value with extra bits set outside the intended write
size, those extra bits will shift into the adjacent bytes and corrupt them.

Fix this my masking 'val' before the shift so only the target bytes are
written. This makes the code do what the comment says and matches the
read function, pci_generic_config_read32().

Fixes: 1f94a94f67e10 ("PCI: Add generic config accessors")
Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
---
 drivers/pci/access.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/access.c b/drivers/pci/access.c
index b123da16b63b..47b38d01694c 100644
--- a/drivers/pci/access.c
+++ b/drivers/pci/access.c
@@ -176,7 +176,7 @@ int pci_generic_config_write32(struct pci_bus *bus, unsigned int devfn,
 
 	mask = ~(((1 << (size * 8)) - 1) << ((where & 0x3) * 8));
 	tmp = readl(addr) & mask;
-	tmp |= val << ((where & 0x3) * 8);
+	tmp |= (val & ((1 << (size * 8)) - 1)) << ((where & 0x3) * 8);
 	writel(tmp, addr);
 
 	return PCIBIOS_SUCCESSFUL;
-- 
2.53.0

Re: [PATCH] PCI: Fix unmasked value in pci_generic_config_write32()

[sashiko-bot]

> When writing less than 4 bytes, pci_generic_config_write32() uses a
> read-modify-write sequence to protect adjacent bytes. The code comment
> states the goal is to "merge in the <size> bits we intend to write".
> 
> However the code does not mask the incoming 'val' before shifting it.
> Since the function 'pci_generic_config_write32()' accepts a 'u32', a
> caller could pass a value with extra bits set outside the intended write
> size, those extra bits will shift into the adjacent bytes and corrupt them.
> 
> Fix this my masking 'val' before the shift so only the target bytes are
> written. This makes the code do what the comment says and matches the
> read function, pci_generic_config_read32().
> 
> Fixes: 1f94a94f67e10 ("PCI: Add generic config accessors")
> Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727075852.4688-1-raizudeen.kerneldev@gmail.com?part=1