Re: [PATCH v9 2/2] PCI: Check rom header and data structure addr before accessing

[Guixin Liu <kanie@linux.alibaba.com>]

在 2025/12/11 22:07, Andy Shevchenko 写道:
> On Thu, Dec 11, 2025 at 08:59:06PM +0800, Guixin Liu wrote:
>> We meet a crash when running stress-ng on x86_64 machine:
>>
>>    BUG: unable to handle page fault for address: ffa0000007f40000
>>    RIP: 0010:pci_get_rom_size+0x52/0x220
>>    Call Trace:
>>    <TASK>
>>      pci_map_rom+0x80/0x130
>>      pci_read_rom+0x4b/0xe0
>>      kernfs_file_read_iter+0x96/0x180
>>      vfs_read+0x1b1/0x300
>>
>> Our analysis reveals that the rom space's start address is
>> 0xffa0000007f30000, and size is 0x10000. Because of broken rom
>> space, before calling readl(pds), the pds's value is
>> 0xffa0000007f3ffff, which is already pointed to the rom space
>> end, invoking readl() would read 4 bytes therefore cause an
>> out-of-bounds access and trigger a crash.
>> Fix this by adding image header and data structure checking.
>>
>> We also found another crash on arm64 machine:
>>
>>    Unable to handle kernel paging request at virtual address
>> ffff8000dd1393ff
>>    Mem abort info:
>>    ESR = 0x0000000096000021
>>    EC = 0x25: DABT (current EL), IL = 32 bits
>>    SET = 0, FnV = 0
>>    EA = 0, S1PTW = 0
>>    FSC = 0x21: alignment fault
>>
>> The call trace is the same with x86_64, but the crash reason is
>> that the data structure addr is not aligned with 4, and arm64
>> machine report "alignment fault". Fix this by adding alignment
>> checking.
> ...
>
>> +#include <linux/align.h>
>>   #include <linux/bits.h>
>> -#include <linux/kernel.h>
>>   #include <linux/export.h>
>> +#include <linux/io.h>
>> +#include <linux/kernel.h>
>> +#include <linux/overflow.h>
>>   #include <linux/pci.h>
>>   #include <linux/slab.h>
>>   #include <linux/sizes.h>
> I would not touch kernel.h position in this patch. The real change (a third one
> if you wish to make that) should replace kernel.h with real includes, making it
> disappear. Now this move is unneeded churn.
>
OK, I will not touch kernel.h in v10.

Best Regards,
Guixin Liu