Re: [PATCH v15 2/2] PCI: Add device-specific reset for Qualcomm WCN6855/WCN7850 WLAN

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] pci: out-of-bounds MMIO read in reset_qualcomm_wlan due to unverified BAR length
--

commit 0bf7ebc364dec72a7a29e6f1e5602ff74fc3a191
Author: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>

PCI: Add device-specific reset for Qualcomm WCN6855/WCN7850 WLAN

Qualcomm WCN6855 and WCN7850 WLAN devices lack working reset methods for
VFIO passthrough scenarios. This commit adds a device-specific reset method
using BAR-space hardware reset registers that exist in these devices.

> diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
> index e72af7d2c7755..e800dd517614e 100644
> --- a/drivers/pci/quirks.c
> +++ b/drivers/pci/quirks.c

[ ... ]

> +static int reset_qualcomm_wlan(struct pci_dev *pdev, bool probe)
> +{
> +	void __iomem *bar;
> +	u32 val;
> +	u16 cmd;
> +	int ret;

[ ... ]

> +	bar = pci_iomap(pdev, 0, 0);
> +	if (!bar) {
> +		pci_write_config_word(pdev, PCI_COMMAND, cmd);
> +		return -ENODEV;
> +	}
> +
> +	val = ioread32(bar + QUALCOMM_WLAN_PCIE_SOC_GLOBAL_RESET);

[Severity: Medium]
Could this lead to an out-of-bounds MMIO read if the device's BAR 0 is
shorter than 0x300C?

The code unconditionally accesses offset 0x3008
(QUALCOMM_WLAN_PCIE_SOC_GLOBAL_RESET) here without verifying if the mapped
memory region is large enough. If an untrusted hardware actor or a spoofed
device exposes a smaller BAR 0 (e.g., 4KB), this access could exceed the
mapped memory boundary and cause a kernel panic due to a page fault.

Would it be safer to verify that pci_resource_len(pdev, 0) is at least
large enough to contain this offset before mapping and reading it?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261005105436.83962-1-jtornosm@redhat.com?part=2