[BUG] nozomi: missing BAR-TYPE check -- writew() on an IOPORT cookie

[BUG] nozomi: missing BAR-TYPE check -- writew() on an IOPORT cookie

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/148-tty-nozomi-writew-on-ioport-cookie/

  nozomi 0000:00:02.0: Card type is: 8192
  BUG: unable to handle page fault for address: 000000000001d044
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  Oops: Oops: 0002 [#1] SMP KASAN NOPTI
  RIP: 0010:nozomi_card_init+0x9fe/0x14c0
  Call Trace:
   nozomi_card_init+0x9fe/0x14c0
   pci_device_probe+0x436/0xc90
   really_probe+0x267/0xaf0
   __driver_probe_device+0x1e2/0x350
   driver_probe_device+0x4f/0x240
   __device_attach_driver+0x270/0x410
   bus_for_each_drv+0x258/0x2f0
   __device_attach+0x2c5/0x450
   drivers_probe_store+0x11c/0x220
   kernfs_fop_write_iter+0x3af/0x540
   ksys_write+0x150/0x270

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,

Re: [BUG] nozomi: missing BAR-TYPE check -- writew() on an IOPORT cookie

[Greg KH]

On Thu, Aug 27, 2026 at 10:33:24PM -0700, Farhad Alemi wrote:
> Hello,
> 
> As part of the kernel research at ASU's SEFCOM
> lab, we hit the crash below. Crash reports can be found here:
> 
>   https://github.com/farhad-alemi/public_bug_reports/tree/main/148-tty-nozomi-writew-on-ioport-cookie/
> 
>   nozomi 0000:00:02.0: Card type is: 8192
>   BUG: unable to handle page fault for address: 000000000001d044
>   #PF: supervisor write access in kernel mode
>   #PF: error_code(0x0002) - not-present page
>   Oops: Oops: 0002 [#1] SMP KASAN NOPTI
>   RIP: 0010:nozomi_card_init+0x9fe/0x14c0
>   Call Trace:
>    nozomi_card_init+0x9fe/0x14c0
>    pci_device_probe+0x436/0xc90
>    really_probe+0x267/0xaf0
>    __driver_probe_device+0x1e2/0x350
>    driver_probe_device+0x4f/0x240
>    __device_attach_driver+0x270/0x410
>    bus_for_each_drv+0x258/0x2f0
>    __device_attach+0x2c5/0x450
>    drivers_probe_store+0x11c/0x220
>    kernfs_fop_write_iter+0x3af/0x540
>    ksys_write+0x150/0x270
> 
> Our reproducer.c is available upon request.
> 
> Happy to test a patch if that would help.

Please send a patch, thanks.

Oh wait, why are you attempting to force drivers to random fake devices?
You have seen this patch set which will taint your kernel if you attempt
such a broken thing to do, right:
	https://lore.kernel.org/r/20260826-bind_taint-v1-0-52b05f4a965c@linuxfoundation.org

Please test that patch set (well, after fixing up the obvious problems
with it...)

greg k-h