Re: [PATCH v1 1/1] PCI: Avoid potential out-of-bounds read in pci_dev_for_each_resource()

[Andy Shevchenko <andriy.shevchenko@linux.intel.com>]

On Fri, Nov 03, 2023 at 01:46:14PM -0500, Bjorn Helgaas wrote:
> On Mon, Oct 30, 2023 at 01:42:18PM +0200, Andy Shevchenko wrote:
> > Coverity complains that pointer in the pci_dev_for_each_resource()
> > may be wrong, i.e. mighe be used for the out-of-bounds read.
> > 
> > There is no actual issue right now, because we have another check
> > afterwards and the out-of-bounds read is not being performed. In any
> > case it's better code with this get fixed, hence the proposed change.
> > 
> > As Jonas pointed out "It probably makes the code slightly less
> > performant as res will now be checked for being not NULL (which will
> > always be true), but I doubt it will be significant (or in any hot
> > paths)."
> > 
> > Fixes: 09cc90063240 ("PCI: Introduce pci_dev_for_each_resource()")
> > Reported-by: Bjorn Helgaas <helgaas@kernel.org>
> > Closes: https://lore.kernel.org/r/20230509182122.GA1259567@bhelgaas
> > Suggested-by: Jonas Gorski <jonas.gorski@gmail.com>
> > Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> 
> Thanks, Andy, I'll look at this soon after v6.7-rc1 (probably Nov 12).

Since it's anyway a non-critical issue, take your time. Based on the tags
it may be backported if needed, so business as usual.

Thank you!

-- 
With Best Regards,
Andy Shevchenko