Re: [PATCH v8 20/25] alpha/PCI: Compute legacy size in pci_mmap_legacy_page_range()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Legacy PCI sysfs interfaces (legacy_mem and legacy_io) bypass the `security_locked_down(LOCKDOWN_PCI_ACCESS)` check.
--

commit db07f943a60b56a40842995e84a339a8791f8af6
Author: Krzysztof Wilczyński <kwilczynski@kernel.org>

alpha/PCI: Compute legacy size in pci_mmap_legacy_page_range()

This commit updates pci_mmap_legacy_page_range() to compute the legacy
resource size directly using PCI_LEGACY_MEM_SIZE and PCI_LEGACY_IO_SIZE
macros. This decouples the bounds check from struct pci_bus fields that
are planned for removal.

> diff --git a/arch/alpha/kernel/pci-sysfs.c b/arch/alpha/kernel/pci-sysfs.c
> index ae448a2e40c54..74c9145e02536 100644
> --- a/arch/alpha/kernel/pci-sysfs.c
> +++ b/arch/alpha/kernel/pci-sysfs.c
> @@ -173,8 +173,11 @@ int pci_mmap_legacy_page_range(struct pci_bus *bus, struct vm_area_struct *vma,
>  	int sparse = has_sparse(hose, mmap_type);
>  	unsigned long res_size;
>  
> -	res_size = (mmap_type == pci_mmap_mem) ? bus->legacy_mem->size :
> -						 bus->legacy_io->size;
> +	res_size = (mmap_type == pci_mmap_mem) ? PCI_LEGACY_MEM_SIZE :
> +						 PCI_LEGACY_IO_SIZE;
> +	if (sparse)
> +		res_size <<= 5;
> +

[Severity: High]
This is a pre-existing issue, but since we are updating the legacy PCI
mmap paths here, I noticed that the generic legacy sysfs interfaces
appear to bypass kernel lockdown restrictions.

Looking at drivers/pci/pci-sysfs.c, functions like pci_mmap_legacy_mem()
and pci_read_legacy_io() do not seem to verify the lockdown status before
granting userspace access to raw PCI memory and I/O ports.

Standard PCI resources correctly check
security_locked_down(LOCKDOWN_PCI_ACCESS) in pci_mmap_resource(), but
the legacy handlers seem to omit this verification.

Could this allow a privileged user to bypass Secure Boot kernel lockdown
by mapping and accessing raw hardware resources directly through these
legacy interfaces?

>  	if (!__legacy_mmap_fits(vma, res_size))
>  		return -EINVAL;
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260619085200.3729431-1-kwilczynski@kernel.org?part=20