Re: [PATCH v2] PCI: quirks: Fix out-of-bounds MMIO read in nvme_disable_and_flr()

[Alex Williamson <alex@shazbot.org>]

On Thu,  3 Sep 2026 09:30:49 +0530
Mohamad Raizudeen <raizudeen.kerneldev@gmail.com> wrote:

> In nvme_disable_and_flr(), the PCI bar is mapped using
> NVME_REG_CC + sizeof(cfg) which is (0x14 + 4 = 0x18 bytes)
> 
> However, the function later reads the controller status from
> NVME_REG_CSTS - offset 0x1C, which is outside the mapped 0x18 byte
> boundary. Reading past the mapped MMIO region is undefined behavior and
> can return invalid data.

"Undefined behavior" still seems an overstatement.  The code violates
the API contract, it should be fixed, but it's effectively harmless
afaict.
 
> Fix this by increasing the mapping size to include NVME_REG_CSTS.
> 
> Fixes: ffb0863426eb9 ("PCI: Disable Samsung SM961/PM961 NVMe before
> FLR") Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
> ---
> Changes in v2:
> - Changed the commit message to avoid overstating the risk as pointed
>   out by Alex Williamson, to be more accurate about the actual
> behavior.
> 
>  drivers/pci/quirks.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
> index b09f27f7846f..ed03892cc960 100644
> --- a/drivers/pci/quirks.c
> +++ b/drivers/pci/quirks.c
> @@ -4090,7 +4090,7 @@ static int nvme_disable_and_flr(struct pci_dev
> *dev, bool probe) if (probe)
>  		return 0;
>  
> -	bar = pci_iomap(dev, 0, NVME_REG_CC + sizeof(cfg));
> +	bar = pci_iomap(dev, 0, NVME_REG_CSTS + sizeof(cfg));
>  	if (!bar)
>  		return -ENOTTY;
>  

The cfg variable is no longer related to the mapping size now, it
happens to be the same size, but this should be sizeof(u32) to avoid
confusion.  Thanks,

Alex