[PATCH] PCI: Fix unmasked value in pci_generic_config_write32()

[PATCH] PCI: Fix unmasked value in pci_generic_config_write32()

[Mohamad Raizudeen]

When writing less than 4 bytes, pci_generic_config_write32() uses a
read-modify-write sequence to protect adjacent bytes. The code comment
states the goal is to "merge in the <size> bits we intend to write".

However the code does not mask the incoming 'val' before shifting it.
Since the function 'pci_generic_config_write32()' accepts a 'u32', a
caller could pass a value with extra bits set outside the intended write
size, those extra bits will shift into the adjacent bytes and corrupt them.

Fix this my masking 'val' before the shift so only the target bytes are
written. This makes the code do what the comment says and matches the
read function, pci_generic_config_read32().

Fixes: 1f94a94f67e10 ("PCI: Add generic config accessors")
Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
---
 drivers/pci/access.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/access.c b/drivers/pci/access.c
index b123da16b63b..47b38d01694c 100644
--- a/drivers/pci/access.c
+++ b/drivers/pci/access.c
@@ -176,7 +176,7 @@ int pci_generic_config_write32(struct pci_bus *bus, unsigned int devfn,
 
 	mask = ~(((1 << (size * 8)) - 1) << ((where & 0x3) * 8));
 	tmp = readl(addr) & mask;
-	tmp |= val << ((where & 0x3) * 8);
+	tmp |= (val & ((1 << (size * 8)) - 1)) << ((where & 0x3) * 8);
 	writel(tmp, addr);
 
 	return PCIBIOS_SUCCESSFUL;
-- 
2.53.0

Re: [PATCH] PCI: Fix unmasked value in pci_generic_config_write32()

[sashiko-bot]

> When writing less than 4 bytes, pci_generic_config_write32() uses a
> read-modify-write sequence to protect adjacent bytes. The code comment
> states the goal is to "merge in the <size> bits we intend to write".
> 
> However the code does not mask the incoming 'val' before shifting it.
> Since the function 'pci_generic_config_write32()' accepts a 'u32', a
> caller could pass a value with extra bits set outside the intended write
> size, those extra bits will shift into the adjacent bytes and corrupt them.
> 
> Fix this my masking 'val' before the shift so only the target bytes are
> written. This makes the code do what the comment says and matches the
> read function, pci_generic_config_read32().
> 
> Fixes: 1f94a94f67e10 ("PCI: Add generic config accessors")
> Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727075852.4688-1-raizudeen.kerneldev@gmail.com?part=1

[PATCH] PCI: Fix unmasked value in pci_generic_config_write32()

[Mohamad Raizudeen]

When writing less than 4 bytes, pci_generic_config_write32() uses a
read-modify-write sequence to protect adjacent bytes. The code comment
states the goal is to "merge in the <size> bits we intend to write".

However the code does not mask the incoming 'val' before shifting it.
Since the function 'pci_generic_config_write32()' accepts a 'u32', a
caller could pass a value with extra bits set outside the intended write
size, those extra bits will shift into the adjacent bytes and corrupt them.

Fix this my masking 'val' before the shift so only the target bytes are
written. This makes the code do what the comment says and matches the
read function, pci_generic_config_read32().

Fixes: 1f94a94f67e10 ("PCI: Add generic config accessors")
Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
---
 drivers/pci/access.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/access.c b/drivers/pci/access.c
index b123da16b63b..47b38d01694c 100644
--- a/drivers/pci/access.c
+++ b/drivers/pci/access.c
@@ -176,7 +176,7 @@ int pci_generic_config_write32(struct pci_bus *bus, unsigned int devfn,
 
 	mask = ~(((1 << (size * 8)) - 1) << ((where & 0x3) * 8));
 	tmp = readl(addr) & mask;
-	tmp |= val << ((where & 0x3) * 8);
+	tmp |= (val & ((1 << (size * 8)) - 1)) << ((where & 0x3) * 8);
 	writel(tmp, addr);
 
 	return PCIBIOS_SUCCESSFUL;
-- 
2.53.0

Re: [PATCH] PCI: Fix unmasked value in pci_generic_config_write32()

[sashiko-bot]

> When writing less than 4 bytes, pci_generic_config_write32() uses a
> read-modify-write sequence to protect adjacent bytes. The code comment
> states the goal is to "merge in the <size> bits we intend to write".
> 
> However the code does not mask the incoming 'val' before shifting it.
> Since the function 'pci_generic_config_write32()' accepts a 'u32', a
> caller could pass a value with extra bits set outside the intended write
> size, those extra bits will shift into the adjacent bytes and corrupt them.
> 
> Fix this my masking 'val' before the shift so only the target bytes are
> written. This makes the code do what the comment says and matches the
> read function, pci_generic_config_read32().
> 
> Fixes: 1f94a94f67e10 ("PCI: Add generic config accessors")
> Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727080643.4949-1-raizudeen.kerneldev@gmail.com?part=1