Re: [tip: x86/msr] x86/pci: Stop using 32-bit MSR interfaces

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Calculation of the segment address overflows when the number of bus bits causes `i` to reach 8 or more.
--

commit 67dc02af5b380e39ab1fd3fd3aa7e4552b01de23
Author: Juergen Gross <jgross@suse.com>
Subject: x86/pci: Stop using 32-bit MSR interfaces

This commit replaces the 32-bit rdmsr_safe() MSR interface with the 64-bit
variant rdmsrq_safe() in the AMD Family 10h PCI MMConfig initialization
code. This simplifies the logic by directly fetching the 64-bit MSR value.

Link: https://patch.msgid.link/20260629060526.3638272-12-jgross@suse.com

> diff --git a/arch/x86/pci/mmconfig-shared.c b/arch/x86/pci/mmconfig-shared.c
> --- a/arch/x86/pci/mmconfig-shared.c
> +++ b/arch/x86/pci/mmconfig-shared.c

[ ... ]

> @@ -198,13 +198,9 @@ static const char *__init pci_mmcfg_amd_fam10h(void)
>  		return NULL;
>  
>  	address = MSR_FAM10H_MMIO_CONF_BASE;
> -	if (rdmsr_safe(address, &low, &high))
> +	if (rdmsrq_safe(address, &msr))
>  		return NULL;
>  
> -	msr = high;
> -	msr <<= 32;
> -	msr |= low;
> -
>  	/* ECAM is not enabled */
>  	if (!(msr & FAM10H_MMIO_CONF_ENABLE))
>  		return NULL;

[ ... ]

> 	end_bus = (1 << busnbits) - 1;
> 	for (i = 0; i < (1 << segnbits); i++)
> 		if (pci_mmconfig_add(i, 0, end_bus,
> 				     base + (1<<28) * i) == NULL) {

[Severity: High]
This isn't a bug introduced by this patch, but does this calculation overflow
when i reaches 8 or more in pci_mmcfg_amd_fam10h()?

The expression (1<<28) * i uses 32-bit signed arithmetic. When i >= 8, the
result reaches 2147483648, which exceeds INT_MAX and overflows to -2147483648.

Because base is a 64-bit value, this negative number will be sign-extended
and subtracted from the base instead of added to it.

If busnbits from the MSR is 12 or greater, segnbits will be 4 or more,
allowing the loop variable i to reach 8 and trigger this overflow.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/178298736191.3843924.4213710231240809260.tip-bot2@tip-bot2?part=1