Re: [PATCH v2 1/6] PCI: Prevent overflow in proc_bus_pci_{read,write}()

[sashiko-bot@kernel.org]

> proc_bus_pci_read() and proc_bus_pci_write() receive the file position
> as a 64-bit loff_t, but store it in 32-bit variables before validating
> the configuration-space bounds.
> 
> In proc_bus_pci_read(), pos is an unsigned int, so an offset such as
> 0x100000000 is truncated to zero. The truncated value passes the bounds
> check and causes the function to read from the beginning of PCI
> configuration space instead of returning EOF.
> 
> In proc_bus_pci_write(), pos is an int, so an offset greater than
> INT_MAX may become negative. The negative value bypasses the
> pos >= size check and is then mixed with the unsigned nbytes value.
> The bounds adjustment may consequently expand a small request into a
> very large transfer, causing the write loop to use invalid negative
> configuration offsets and run for an excessive amount of time.
> 
> Fix this by changing the type of pos to loff_t.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> Signed-off-by: Yongqiang Liu <liuyongqiang13@huawei.com>
> Signed-off-by: Ziming Du <duziming2@huawei.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260730032438.1643450-1-duziming2@huawei.com?part=1