Re: [PATCH v8 22/25] PCI/sysfs: Add legacy I/O and memory attribute macros

["Krzysztof Wilczyński" <kwilczynski@kernel.org>]

Hello,

> [Severity: High]
> This isn't a bug introduced by this patch, but can the use of
> pci_write_legacy_io() here trigger an out-of-bounds heap read?
> 
> When a user writes 1 or 2 bytes to a legacy_io sysfs file,
> kernfs_fop_write_iter() allocates a buffer of count + 1 bytes.
> 
> In pci_write_legacy_io(), after validating count is 1, 2, or 4, the buffer is
> cast and unconditionally dereferenced as a u32:
> 
> drivers/pci/pci-sysfs.c:pci_write_legacy_io() {
>         /* Only support 1, 2 or 4 byte accesses */
>         if (count != 1 && count != 2 && count != 4)
>                 return -EINVAL;
> 
>         return pci_legacy_write(bus, off, *(u32 *)buf, count);
> }
> 
> Does the *(u32 *)buf dereference cause a 4-byte read from the smaller 2-byte
> or 3-byte buffer, potentially triggering a KASAN slab-out-of-bounds read?

A known issue for which a patch with a fix has been sent.

Thank you!

	Krzysztof