[PATCH v2] PCI: quirks: Fix out-of-bounds MMIO read in mellanox_check_broken_intx_masking()

[PATCH v2] PCI: quirks: Fix out-of-bounds MMIO read in mellanox_check_broken_intx_masking()

[Mohamad Raizudeen]

The mellanox_check_broken_intx_masking() function maps 4 bytes of MMIO
memory using ioremap() with a size of 4 bytes, but then reads two 32 bit
values using ioread32be(fw_ver) and ioread32be(fw_ver + 1).

Because fw_ver is a pointer to a 32 bit type, fw_ver + 1 advances the
address by 4 bytes. Reading 4 bytes at offset 4 goes past the mapped 4
byte boundary. This violates the API contract.

Fix this by increasing the mapping size to 8 bytes to safely cover both
32 bits.

Fixes: 1600f62534b7b ("PCI: support INTx masking on ConnectX-4 with firmware x.14.1100+")
Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
---
Changes in v2:
- Fixed a typo in the commit message("ad" -> "and").
- Updated commit message to use "violates the API contract" instead of
  "page fault or kernel panic" to avoid overstating the risk, matching
  the feedback from Alex Williamson on a similar patch.

Link for v1: https://lore.kernel.org/linux-pci/20260827071940.B7CC01F000E9@smtp.kernel.org/T/

 drivers/pci/quirks.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index de9bbccda21f..b30ca4244f14 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3714,7 +3714,7 @@ static void mellanox_check_broken_intx_masking(struct pci_dev *pdev)
 		return;
 	}
 
-	fw_ver = ioremap(pci_resource_start(pdev, 0), 4);
+	fw_ver = ioremap(pci_resource_start(pdev, 0), 8);
 	if (!fw_ver) {
 		pci_warn(pdev, "Can't map ConnectX-4 initialization segment\n");
 		goto out;
-- 
2.53.0

Re: [PATCH v2] PCI: quirks: Fix out-of-bounds MMIO read in mellanox_check_broken_intx_masking()

[sashiko-bot]

> The mellanox_check_broken_intx_masking() function maps 4 bytes of MMIO
> memory using ioremap() with a size of 4 bytes, but then reads two 32 bit
> values using ioread32be(fw_ver) and ioread32be(fw_ver + 1).
> 
> Because fw_ver is a pointer to a 32 bit type, fw_ver + 1 advances the
> address by 4 bytes. Reading 4 bytes at offset 4 goes past the mapped 4
> byte boundary. This violates the API contract.
> 
> Fix this by increasing the mapping size to 8 bytes to safely cover both
> 32 bits.
> 
> Fixes: 1600f62534b7b ("PCI: support INTx masking on ConnectX-4 with firmware x.14.1100+")
> Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260905161743.5766-1-raizudeen.kerneldev@gmail.com?part=1