From: "Krzysztof Wilczyński" <kwilczynski@kernel.org>
To: Bjorn Helgaas <bhelgaas@google.com>
Cc: "Bjorn Helgaas" <helgaas@kernel.org>,
"Manivannan Sadhasivam" <mani@kernel.org>,
"Lorenzo Pieralisi" <lpieralisi@kernel.org>,
"Alex Williamson" <alex@shazbot.org>,
"Magnus Lindholm" <linmag7@gmail.com>,
"Matt Turner" <mattst88@gmail.com>,
"Richard Henderson" <richard.henderson@linaro.org>,
"Christophe Leroy" <chleroy@kernel.org>,
"Madhavan Srinivasan" <maddy@linux.ibm.com>,
"Michael Ellerman" <mpe@ellerman.id.au>,
"Nicholas Piggin" <npiggin@gmail.com>,
"Dexuan Cui" <decui@microsoft.com>,
"Krzysztof Hałasa" <khalasa@piap.pl>,
"Lukas Wunner" <lukas@wunner.de>,
"Oliver O'Halloran" <oohall@gmail.com>,
"Saurabh Singh Sengar" <ssengar@microsoft.com>,
"Shuan He" <heshuan@bytedance.com>,
"Srivatsa Bhat" <srivatsabhat@microsoft.com>,
"Ilpo Järvinen" <ilpo.jarvinen@linux.intel.com>,
linux-pci@vger.kernel.org, linux-alpha@vger.kernel.org,
linuxppc-dev@lists.ozlabs.org
Subject: [PATCH v7 14/24] alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs
Date: Fri, 8 May 2026 04:35:33 +0000 [thread overview]
Message-ID: <20260508043543.217179-15-kwilczynski@kernel.org> (raw)
In-Reply-To: <20260508043543.217179-1-kwilczynski@kernel.org>
Currently, __pci_mmap_fits() computes the BAR size using
pci_resource_len() - 1, which wraps to a large value when the
BAR length is zero, causing the bounds check to incorrectly
succeed.
Thus, add an early return for empty resources.
Fixes: 10a0ef39fbd1 ("PCI/alpha: pci sysfs resources")
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Acked-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
---
arch/alpha/kernel/pci-sysfs.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/arch/alpha/kernel/pci-sysfs.c b/arch/alpha/kernel/pci-sysfs.c
index 5c29f1d2821c..8802f955256e 100644
--- a/arch/alpha/kernel/pci-sysfs.c
+++ b/arch/alpha/kernel/pci-sysfs.c
@@ -37,12 +37,16 @@ static int hose_mmap_page_range(struct pci_controller *hose,
static int __pci_mmap_fits(struct pci_dev *pdev, int num,
struct vm_area_struct *vma, int sparse)
{
+ resource_size_t len = pci_resource_len(pdev, num);
unsigned long nr, start, size;
int shift = sparse ? 5 : 0;
+ if (!len)
+ return 0;
+
nr = vma_pages(vma);
start = vma->vm_pgoff;
- size = ((pci_resource_len(pdev, num) - 1) >> (PAGE_SHIFT - shift)) + 1;
+ size = ((len - 1) >> (PAGE_SHIFT - shift)) + 1;
if (start < size && size - start >= nr)
return 1;
--
2.54.0
next prev parent reply other threads:[~2026-05-08 4:36 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-08 4:35 [PATCH v7 00/24] PCI: Convert all dynamic sysfs attributes to static Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 01/24] PCI/sysfs: Use PCI resource accessor macros Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 02/24] PCI: Add pci_resource_is_io() and pci_resource_is_mem() helpers Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 03/24] PCI/sysfs: Only allow supported resource types in I/O and MMIO helpers Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 04/24] PCI/sysfs: Split pci_llseek_resource() for device and legacy attributes Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 05/24] PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 06/24] PCI/sysfs: Add static PCI resource attribute macros Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 07/24] PCI/sysfs: Convert PCI resource files to static attributes Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 08/24] PCI/sysfs: Warn about BAR resize failure in __resource_resize_store() Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 09/24] PCI/sysfs: Add stubs for pci_{create,remove}_sysfs_dev_files() Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 10/24] PCI/sysfs: Limit pci_sysfs_init() late_initcall compile scope Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 11/24] alpha/PCI: Add security_locked_down() check to pci_mmap_resource() Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 12/24] alpha/PCI: Use BAR index in sysfs attr->private instead of resource pointer Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 13/24] alpha/PCI: Use PCI resource accessor macros Krzysztof Wilczyński
2026-05-08 4:35 ` Krzysztof Wilczyński [this message]
2026-05-08 4:35 ` [PATCH v7 15/24] alpha/PCI: Remove WARN from __pci_mmap_fits() and __legacy_mmap_fits() Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 16/24] alpha/PCI: Add static PCI resource attribute macros Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 17/24] alpha/PCI: Convert resource files to static attributes Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 18/24] PCI/sysfs: Remove pci_{create,remove}_sysfs_dev_files() Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 19/24] PCI: Add macros for legacy I/O and memory address space sizes Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 20/24] alpha/PCI: Compute legacy size in pci_mmap_legacy_page_range() Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 21/24] PCI/sysfs: Add __weak pci_legacy_has_sparse() helper Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 22/24] PCI/sysfs: Convert legacy I/O and memory attributes to static definitions Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 23/24] PCI/sysfs: Remove pci_create_legacy_files() and pci_sysfs_init() Krzysztof Wilczyński
2026-05-08 4:35 ` [PATCH v7 24/24] PCI/sysfs: Limit BAR resize attribute scope to platforms with PCI mmap Krzysztof Wilczyński
2026-05-08 23:00 ` [PATCH v7 00/24] PCI: Convert all dynamic sysfs attributes to static Bjorn Helgaas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260508043543.217179-15-kwilczynski@kernel.org \
--to=kwilczynski@kernel.org \
--cc=alex@shazbot.org \
--cc=bhelgaas@google.com \
--cc=chleroy@kernel.org \
--cc=decui@microsoft.com \
--cc=helgaas@kernel.org \
--cc=heshuan@bytedance.com \
--cc=ilpo.jarvinen@linux.intel.com \
--cc=khalasa@piap.pl \
--cc=linmag7@gmail.com \
--cc=linux-alpha@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=lpieralisi@kernel.org \
--cc=lukas@wunner.de \
--cc=maddy@linux.ibm.com \
--cc=mani@kernel.org \
--cc=mattst88@gmail.com \
--cc=mpe@ellerman.id.au \
--cc=npiggin@gmail.com \
--cc=oohall@gmail.com \
--cc=richard.henderson@linaro.org \
--cc=srivatsabhat@microsoft.com \
--cc=ssengar@microsoft.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox