[PATCH] PCI: quirks: Fix out-of-bounds MMIO read in mellanox_check_broken_intx_masking()

[PATCH] PCI: quirks: Fix out-of-bounds MMIO read in mellanox_check_broken_intx_masking()

[Mohamad Raizudeen]

The mellanox_check_broken_intx_masking() function maps 4 bytes of MMIO
memory using ioremap(), but then reads two 32 bit values using
ioread32be(fw_ver) ad ioread32be(fw_ver + 1).

Because fw_ver is a pointer to a 32 bit type, fw_ver + 1 advances the
address by 4 bytes. Reading 4 bytes at offset 4 goes past the mapped 4
byte boundary. This out-of-bounds read can cause a page fault or kernel
panic on architectures that enforce strict MMIO boundaries.

Fix this by increasing the mapping size to 8 bytes to safely cover both
32 bits.

Fixes: 1600f62534b7 ("PCI: Support INTx masking on ConnectX-4 with firmware x.14.1100+")
Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
---
 drivers/pci/quirks.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index de9bbccda21f..b30ca4244f14 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3714,7 +3714,7 @@ static void mellanox_check_broken_intx_masking(struct pci_dev *pdev)
 		return;
 	}
 
-	fw_ver = ioremap(pci_resource_start(pdev, 0), 4);
+	fw_ver = ioremap(pci_resource_start(pdev, 0), 8);
 	if (!fw_ver) {
 		pci_warn(pdev, "Can't map ConnectX-4 initialization segment\n");
 		goto out;
-- 
2.53.0

Re: [PATCH] PCI: quirks: Fix out-of-bounds MMIO read in mellanox_check_broken_intx_masking()

[sashiko-bot]

> The mellanox_check_broken_intx_masking() function maps 4 bytes of MMIO
> memory using ioremap(), but then reads two 32 bit values using
> ioread32be(fw_ver) ad ioread32be(fw_ver + 1).
> 
> Because fw_ver is a pointer to a 32 bit type, fw_ver + 1 advances the
> address by 4 bytes. Reading 4 bytes at offset 4 goes past the mapped 4
> byte boundary. This out-of-bounds read can cause a page fault or kernel
> panic on architectures that enforce strict MMIO boundaries.
> 
> Fix this by increasing the mapping size to 8 bytes to safely cover both
> 32 bits.
> 
> Fixes: 1600f62534b7 ("PCI: Support INTx masking on ConnectX-4 with firmware x.14.1100+")
> Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260827071439.4480-1-raizudeen.kerneldev@gmail.com?part=1