[PATCH] thunderbolt: Validate BAR 0 resource type and size

[PATCH] thunderbolt: Validate BAR 0 resource type and size

[syzbot]

From: Marco Elver <elver@google.com>

The thunderbolt driver can crash with a page fault if it binds to an
arbitrary PCI device (e.g., via sysfs driver_override) that has an I/O port
BAR at index 0 instead of an MMIO BAR.

The driver maps this BAR without validating its type or size. When it
attempts to read a Thunderbolt register at a large offset, the resulting
I/O port cookie overflows the reserved PIO space on x86. This causes the
generic ioread32() function to misinterpret the out-of-bounds I/O port
cookie as a valid MMIO virtual address, leading to a direct dereference of
an unmapped physical-like address and a page fault:

  BUG: unable to handle page fault for address: 00000000000556c0
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  ...
  Call Trace:
   <TASK>
   nhi_probe+0xcc/0x870 drivers/thunderbolt/nhi.c:1198
   nhi_pci_probe+0x46b/0x580 drivers/thunderbolt/pci.c:479
   local_pci_probe drivers/pci/pci-driver.c:332 [inline]
   pci_call_probe drivers/pci/pci-driver.c:394 [inline]
   __pci_device_probe drivers/pci/pci-driver.c:455 [inline]
   pci_device_probe+0x431/0xc90 drivers/pci/pci-driver.c:489

To fix this, add explicit validation in nhi_pci_probe() to ensure that BAR
0 is an MMIO resource and is large enough to contain all the NHI registers
before attempting to map it. The NHI register space extends up to offset
0x39944 (REG_FW_STS), so checking for a minimum size of 0x40000 (256 KB) is
appropriate.

Fixes: 16603153666d ("thunderbolt: Add initial cactus ridge NHI support")
Assisted-by: Gemini:gemini-3.7-flash Gemini:gemini-3.1-pro-preview syzbot
Reported-by: syzbot+97999b836ee62ddb0181@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=97999b836ee62ddb0181
Link: https://syzkaller.appspot.com/ai_job?id=2570f821-2184-40c8-8bd7-344a30c18a13
Signed-off-by: Marco Elver <elver@google.com>

---
diff --git a/drivers/thunderbolt/nhi_regs.h b/drivers/thunderbolt/nhi_regs.h
index d6a197fab..1feb0bfb0 100644
--- a/drivers/thunderbolt/nhi_regs.h
+++ b/drivers/thunderbolt/nhi_regs.h
@@ -140,6 +140,9 @@ struct ring_desc {
 #define REG_FW_STS_ICM_EN_INVERT	BIT(1)
 #define REG_FW_STS_ICM_EN		BIT(0)
 
+/* Minimum BAR size to contain NHI registers */
+#define NHI_MIN_BAR_SIZE		0x40000
+
 /* ICL NHI VSEC registers */
 
 /* FW ready */
diff --git a/drivers/thunderbolt/pci.c b/drivers/thunderbolt/pci.c
index bbd186c29..fa69e4609 100644
--- a/drivers/thunderbolt/pci.c
+++ b/drivers/thunderbolt/pci.c
@@ -466,6 +466,14 @@ static int nhi_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	nhi->dev = dev;
 	nhi->ops = (const struct tb_nhi_ops *)id->driver_data ?: &pci_nhi_default_ops;
 
+	/* Ensure BAR 0 is an MMIO resource */
+	if (!(pci_resource_flags(pdev, 0) & IORESOURCE_MEM))
+		return dev_err_probe(dev, -EINVAL, "BAR 0 is not an MMIO resource\n");
+
+	/* Ensure BAR 0 is large enough to contain the NHI registers */
+	if (pci_resource_len(pdev, 0) < NHI_MIN_BAR_SIZE)
+		return dev_err_probe(dev, -EINVAL, "BAR 0 is too small\n");
+
 	nhi->iobase = pcim_iomap_region(pdev, 0, "thunderbolt");
 	res = PTR_ERR_OR_ZERO(nhi->iobase);
 	if (res)


base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
-- 
See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
The person who has signed off on the patch is responsible for
addressing comments.
syzbot engineers can be reached at syzkaller@googlegroups.com.

Re: [PATCH] thunderbolt: Validate BAR 0 resource type and size

[Mika Westerberg]

Hi,

On Tue, Aug 25, 2026 at 04:09:37PM +0000, syzbot wrote:
> From: Marco Elver <elver@google.com>
> 
> The thunderbolt driver can crash with a page fault if it binds to an
> arbitrary PCI device (e.g., via sysfs driver_override) that has an I/O port
> BAR at index 0 instead of an MMIO BAR.

Well, if you bind it to a random PCIe device you get what you asked for.
This is specifically the reason we have the PCI IDs and the like in the
drivers. Anything outside of that you need to know what you are doing.

Re: [PATCH] thunderbolt: Validate BAR 0 resource type and size

[Greg KH]

On Wed, Aug 26, 2026 at 06:39:29AM +0200, Mika Westerberg wrote:
> Hi,
> 
> On Tue, Aug 25, 2026 at 04:09:37PM +0000, syzbot wrote:
> > From: Marco Elver <elver@google.com>
> > 
> > The thunderbolt driver can crash with a page fault if it binds to an
> > arbitrary PCI device (e.g., via sysfs driver_override) that has an I/O port
> > BAR at index 0 instead of an MMIO BAR.
> 
> Well, if you bind it to a random PCIe device you get what you asked for.
> This is specifically the reason we have the PCI IDs and the like in the
> drivers. Anything outside of that you need to know what you are doing.
> 

And again, I keep telling the syzbot people that this is not a valid
thing to care about...