Re: [PATCH v8 18/25] PCI/sysfs: Remove pci_{create,remove}_sysfs_dev_files()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] PCI resource sysfs files are exposed to userspace before their resources are assigned.
--

commit 650a832c0afdbb810823f509ec90847d6a613433
Author: Krzysztof Wilczyński <kwilczynski@kernel.org>

PCI/sysfs: Remove pci_{create,remove}_sysfs_dev_files()

Currently, pci_create_sysfs_dev_files() and pci_remove_sysfs_dev_files()
are no-op stubs. With both the generic and Alpha resource files now
handled by static attribute groups, no platform needs dynamic per-device
sysfs file creation.

> diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
> index 6c1ad1f542d9b..655ed53436d3e 100644
> --- a/drivers/pci/bus.c
> +++ b/drivers/pci/bus.c
> @@ -354,7 +354,6 @@ void pci_bus_add_device(struct pci_dev *dev)
>  	pci_fixup_device(pci_fixup_final, dev);
>  	if (pci_is_bridge(dev))
>  		of_pci_make_dev_node(dev);
> -	pci_create_sysfs_dev_files(dev);

[Severity: High]
With the transition to static attribute groups handling the resource files,
are the resources being exposed to userspace before they are actually assigned?

Static attribute groups are created early during device_add() in
pci_device_add(). If firmware has not programmed the BARs at this stage, the
resources remain unassigned with start = 0 and the IORESOURCE_UNSET flag.

Looking at the visibility callback in drivers/pci/pci-sysfs.c:

__pci_resource_attr_is_visible()
{
	...
	if (!pci_resource_len(pdev, bar))
		return 0;

	if ((pci_resource_flags(pdev, bar) & flags) != flags)
		return 0;
	...
}

There is no check for IORESOURCE_UNSET.

Since device_add() triggers a KOBJ_ADD uevent, could userspace immediately open
these files before pci_assign_unassigned_bus_resources() assigns the actual
addresses?

If userspace reads or writes an I/O resource file during this window,
pci_resource_io() would use start = 0, which could allow arbitrary root writes
to I/O port 0 and potentially crash the system.

>  	pci_proc_attach_device(dev);
>  	pci_bridge_d3_update(dev);
>  

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260619085200.3729431-1-kwilczynski@kernel.org?part=18