Re: [PATCH v3 4/8] PCI: Fix nesting windows with remainder at the left edge

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] pci: uninitialized variable causes random bypass of remainder logic
--

commit d763cceb79214019a0738e421be1a8a6485d37bc
Author: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>

PCI: Fix nesting windows with remainder at the left edge

If a bridge window has its non-aligning remainder at the left edge of
the window, assigning a nested bridge window of same size will fail
because resource side code will only allow starting a candicate range
from an aligning address. In such case, aligned address is somewhere in
the middle, not at the left edge of the window. Since the entire
available space is required for full-sized nested bridge window,
resource side code rejects the free space.

> diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
> index 441a62807719d..2ca3784aa323f 100644
> --- a/drivers/pci/setup-res.c
> +++ b/drivers/pci/setup-res.c
[ ... ]
> @@ -324,9 +366,17 @@ static int __pci_assign_resource(struct pci_bus *bus, struct pci_dev *dev,
>  	int ret;
>  
>  	pci_init_pci_resreq_data(&rr, dev);
> +	rr.real_align = align;
>  
>  	min = (res->flags & IORESOURCE_IO) ? PCIBIOS_MIN_IO : PCIBIOS_MIN_MEM;
>  
> +	if (!rr.user_align &&
> +	    (res->flags & IORESOURCE_MEM) && pci_resreq_remainder(size, align)) {
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

[Severity: High]
Does the remainder logic rely on rr.user_align being reliably initialized to 0
for non-overridden resources?

In include/linux/pci.h, pci_init_pci_resreq_data() declares an uninitialized
variable bool user_aligned; and passes it by reference:

include/linux/pci.h:pci_init_pci_resreq_data() {
    bool user_aligned;
    ...
    rr->user_align = pci_specified_resource_alignment(dev, &user_aligned);
    if (!user_aligned)
        rr->user_align = 0;
}

If the user did not specify an alignment parameter,
pci_specified_resource_alignment() returns early without writing to
user_aligned:

drivers/pci/pci.c:pci_specified_resource_alignment() {
    ...
    if (!p || !*p)
        goto out;
    ...
out:
    return pcibios_default_alignment();
}

If the stack garbage in user_aligned evaluates to true, rr->user_align
incorrectly retains pcibios_default_alignment(). On architectures where
pcibios_default_alignment() is non-zero (like powernv), rr.user_align
becomes non-zero, causing !rr.user_align to evaluate to false. This skips
the align = 1U override randomly, breaking the remainder alignment logic
for nested bridge windows.

> +		align = 1U;
> +		if (pci_resource_is_bridge_win(resno))
> +			align = pci_min_window_alignment(bus, res->flags);
> +	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013130948.6231-1-ilpo.jarvinen@linux.intel.com?part=4