From: "Krzysztof Wilczyński" <kwilczynski@kernel.org>
To: Bjorn Helgaas <bhelgaas@google.com>
Cc: Bjorn Helgaas <helgaas@kernel.org>,
Manivannan Sadhasivam <mani@kernel.org>,
Lorenzo Pieralisi <lpieralisi@kernel.org>,
Ira Weiny <iweiny@kernel.org>, Kees Cook <kees@kernel.org>,
linux-pci@vger.kernel.org
Subject: [PATCH] PCI/proc: Warn on writes to kernel-exclusive config space regions
Date: Wed, 29 Jul 2026 07:54:13 +0000 [thread overview]
Message-ID: <20260729075413.1215821-1-kwilczynski@kernel.org> (raw)
Currently, a driver can claim a region of a device's config space as
exclusive using pci_request_config_region_exclusive(), after which a
write to that region originating from user space is expected to emit a
warning and taint the kernel. The check is advisory only, as the write
itself is still allowed to proceed.
Since commit 278294798ac9 ("PCI: Allow drivers to request exclusive
config regions"), the sysfs config space attribute performs this check
in pci_write_config(), but the procfs interface was never updated. A
write performed through /proc/bus/pci/BB/DD.F therefore bypasses the
detection entirely, even though both interfaces offer the same level
of access.
Thus, add the same resource_is_exclusive() check to proc_bus_pci_write().
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
---
drivers/pci/proc.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
index 71ad289fcb8e..12200979d3a8 100644
--- a/drivers/pci/proc.c
+++ b/drivers/pci/proc.c
@@ -14,6 +14,8 @@
#include <linux/capability.h>
#include <linux/uaccess.h>
#include <linux/security.h>
+#include <linux/panic.h>
+#include <linux/sched.h>
#include <asm/byteorder.h>
#include "pci.h"
@@ -122,6 +124,12 @@ static ssize_t proc_bus_pci_write(struct file *file, const char __user *buf,
if (ret)
return ret;
+ if (resource_is_exclusive(&dev->driver_exclusive_resource, pos, nbytes)) {
+ pci_warn_once(dev, "%s: Unexpected write to kernel-exclusive config offset %x",
+ current->comm, pos);
+ add_taint(TAINT_USER, LOCKDEP_STILL_OK);
+ }
+
if (pos >= size)
return 0;
if (nbytes >= size)
--
2.55.0
next reply other threads:[~2026-07-29 7:54 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-29 7:54 Krzysztof Wilczyński [this message]
2026-07-29 8:13 ` [PATCH] PCI/proc: Warn on writes to kernel-exclusive config space regions sashiko-bot
2026-08-01 4:06 ` Krzysztof Wilczyński
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260729075413.1215821-1-kwilczynski@kernel.org \
--to=kwilczynski@kernel.org \
--cc=bhelgaas@google.com \
--cc=helgaas@kernel.org \
--cc=iweiny@kernel.org \
--cc=kees@kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=lpieralisi@kernel.org \
--cc=mani@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.