Re: [PATCH v2 6/6] PCI: Align proc_bus_pci_read() with pci_read_config()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unaligned pointer dereference via `__put_user` cast.
--

--- Patch [6]: [PATCH v2 6/6] PCI: Align proc_bus_pci_read() with pci_read_config() ---
commit 214117562117fd4692f3111d71550ff1bd6ab306
Author: Ziming Du <duziming2@huawei.com>

PCI: Align proc_bus_pci_read() with pci_read_config()

This commit aligns the implementation of proc_bus_pci_read() with
pci_read_config() to improve consistency. It renames variables and updates
the transfer loop conditions without intending functional changes.

> diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
> index 71d1f34e13a7d..13ac92da4624b 100644
> --- a/drivers/pci/proc.c
> +++ b/drivers/pci/proc.c
[ ... ]
> @@ -46,66 +47,65 @@ static ssize_t proc_bus_pci_read(struct file *file, char __user *buf,
[ ... ]
> -	while (cnt >= 4) {
> +	while (count > 3) {
>  		unsigned int val;
> -		pci_user_read_config_dword(dev, pos, &val);
> +		pci_user_read_config_dword(dev, off, &val);
>  		__put_user(cpu_to_le32(val), (__le32 __user *) buf);

[Severity: High]
This is a pre-existing issue, but could this cast and dereference trigger
an alignment exception on strict-alignment architectures?

If a normal user opens a PCI config file and calls read() with an aligned
file offset but an unaligned buffer address, the read chunks are aligned
based on the file offset, bypassing the earlier byte and word branches.
The execution would then reach this 32-bit __put_user cast with the
unaligned user buffer.

On architectures that do not emulate unaligned kernel-mode accesses like
older ARM or SPARC, this might result in a local denial of service via a
kernel oops or panic.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260730032438.1643450-1-duziming2@huawei.com?part=6