Re: [PATCH v15 2/2] PCI: Add device-specific reset for Qualcomm WCN6855/WCN7850 WLAN

[Jose Ignacio Tornos Martinez <jtornosm@redhat.com>]

> [Severity: Medium]
> Could this lead to an out-of-bounds MMIO read if the device's BAR 0 is
> shorter than 0x300C?
>
> The code unconditionally accesses offset 0x3008
> (QUALCOMM_WLAN_PCIE_SOC_GLOBAL_RESET) here without verifying if the mapped
> memory region is large enough. If an untrusted hardware actor or a spoofed
> device exposes a smaller BAR 0 (e.g., 4KB), this access could exceed the
> mapped memory boundary and cause a kernel panic due to a page fault.
>
> Would it be safer to verify that pci_resource_len(pdev, 0) is at least
> large enough to contain this offset before mapping and reading it?

These are device-specific resets matched by PCI vendor/device ID, so
the BAR0 layout is known and fixed for these devices. The BAR0 size
for these Qualcomm WLAN devices is well above 0x300C.