Re: [PATCH v7] PCI: vmd: Add feature to scan BIOS enumerated devices.

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Unvalidated BAR 4 length could lead to an out-of-bounds read when accessing shadow registers.
--

commit 7affe7834934181c54062f23e6c8641c3fb30366
Author: Nirmal Patel <nirmal.patel@linux.intel.com>

PCI: vmd: Add feature to scan BIOS enumerated devices.

This commit adds support for newer VMD devices (ID 0x28c1) that rely on
the BIOS to enumerate the device tree and configure settings. It retrieves
the bus hide range and shadow register values from the VMD MMIO space in
BAR4/BAR5 and uses them to perform a bus scan.

> diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
> index d4ae250d4bc6d..a02f2cc3d6ede 100644
> --- a/drivers/pci/controller/vmd.c
> +++ b/drivers/pci/controller/vmd.c

[ ... ]

> @@ -661,6 +706,46 @@ static int vmd_get_bus_number_start(struct vmd_dev *vmd)
>  	return 0;
>  }
>  
> +static int vmd_get_bus_info_from_bar4(struct vmd_dev *vmd,
> +				       resource_size_t *offset1,
> +				       resource_size_t *offset2)
> +{
> +	u64 phys1, phys2, bar4_2840;
> +	void __iomem *bar4;
> +	u32 base_id;
> +	u8 base_bus;
> +
> +	bar4 = pci_ioremap_bar(vmd->dev, 4);
> +	if (!bar4)
> +		return -ENOMEM;
> +
> +	/* Read shadow registers for MEMBAR1 and MEMBAR2 physical addresses. */
> +	phys1 = readq(bar4 + SHADOW_MEMBAR1_28C1);

[Severity: High]
Can this cause an out-of-bounds read if the resource size of BAR 4 is
smaller than the SHADOW_MEMBAR1_28C1 offset?

If a malicious PCIe device (for example, connected via Thunderbolt) spoofs
the VMD device ID but presents a malformed, small BAR 4 (e.g., 4 KB),
pci_ioremap_bar() will only map the smaller size. The readq() call here
would then access unmapped memory, which could trigger a kernel panic via
a page fault in kernel mode.

Is there a way to validate the length of the BAR 4 resource against
the expected offsets before accessing these shadow registers?

> +	phys2 = readq(bar4 + SHADOW_MEMBAR2_28C1);

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260629165025.268836-1-nirmal.patel@linux.intel.com?part=1