[PATCH v2] PCI: quirks: Fix out-of-bounds MMIO read in nvme_disable_and_flr()

[PATCH v2] PCI: quirks: Fix out-of-bounds MMIO read in nvme_disable_and_flr()

[Mohamad Raizudeen]

In nvme_disable_and_flr(), the PCI bar is mapped using
NVME_REG_CC + sizeof(cfg) which is (0x14 + 4 = 0x18 bytes)

However, the function later reads the controller status from
NVME_REG_CSTS - offset 0x1C, which is outside the mapped 0x18 byte
boundary. Reading past the mapped MMIO region is undefined behavior and
can return invalid data.

Fix this by increasing the mapping size to include NVME_REG_CSTS.

Fixes: ffb0863426eb9 ("PCI: Disable Samsung SM961/PM961 NVMe before FLR")
Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
---
Changes in v2:
- Changed the commit message to avoid overstating the risk as pointed
  out by Alex Williamson, to be more accurate about the actual behavior.

 drivers/pci/quirks.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index b09f27f7846f..ed03892cc960 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -4090,7 +4090,7 @@ static int nvme_disable_and_flr(struct pci_dev *dev, bool probe)
 	if (probe)
 		return 0;
 
-	bar = pci_iomap(dev, 0, NVME_REG_CC + sizeof(cfg));
+	bar = pci_iomap(dev, 0, NVME_REG_CSTS + sizeof(cfg));
 	if (!bar)
 		return -ENOTTY;
 
-- 
2.53.0

Re: [PATCH v2] PCI: quirks: Fix out-of-bounds MMIO read in nvme_disable_and_flr()

[sashiko-bot]

> In nvme_disable_and_flr(), the PCI bar is mapped using
> NVME_REG_CC + sizeof(cfg) which is (0x14 + 4 = 0x18 bytes)
> 
> However, the function later reads the controller status from
> NVME_REG_CSTS - offset 0x1C, which is outside the mapped 0x18 byte
> boundary. Reading past the mapped MMIO region is undefined behavior and
> can return invalid data.
> 
> Fix this by increasing the mapping size to include NVME_REG_CSTS.
> 
> Fixes: ffb0863426eb9 ("PCI: Disable Samsung SM961/PM961 NVMe before FLR")
> Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260903040049.5460-1-raizudeen.kerneldev@gmail.com?part=1

Re: [PATCH v2] PCI: quirks: Fix out-of-bounds MMIO read in nvme_disable_and_flr()

[Alex Williamson]

On Thu,  3 Sep 2026 09:30:49 +0530
Mohamad Raizudeen <raizudeen.kerneldev@gmail.com> wrote:

> In nvme_disable_and_flr(), the PCI bar is mapped using
> NVME_REG_CC + sizeof(cfg) which is (0x14 + 4 = 0x18 bytes)
> 
> However, the function later reads the controller status from
> NVME_REG_CSTS - offset 0x1C, which is outside the mapped 0x18 byte
> boundary. Reading past the mapped MMIO region is undefined behavior and
> can return invalid data.

"Undefined behavior" still seems an overstatement.  The code violates
the API contract, it should be fixed, but it's effectively harmless
afaict.
 
> Fix this by increasing the mapping size to include NVME_REG_CSTS.
> 
> Fixes: ffb0863426eb9 ("PCI: Disable Samsung SM961/PM961 NVMe before
> FLR") Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
> ---
> Changes in v2:
> - Changed the commit message to avoid overstating the risk as pointed
>   out by Alex Williamson, to be more accurate about the actual
> behavior.
> 
>  drivers/pci/quirks.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
> index b09f27f7846f..ed03892cc960 100644
> --- a/drivers/pci/quirks.c
> +++ b/drivers/pci/quirks.c
> @@ -4090,7 +4090,7 @@ static int nvme_disable_and_flr(struct pci_dev
> *dev, bool probe) if (probe)
>  		return 0;
>  
> -	bar = pci_iomap(dev, 0, NVME_REG_CC + sizeof(cfg));
> +	bar = pci_iomap(dev, 0, NVME_REG_CSTS + sizeof(cfg));
>  	if (!bar)
>  		return -ENOTTY;
>  

The cfg variable is no longer related to the mapping size now, it
happens to be the same size, but this should be sizeof(u32) to avoid
confusion.  Thanks,

Alex

Re: [PATCH v2] PCI: quirks: Fix out-of-bounds MMIO read in nvme_disable_and_flr()

[Mohamad Raizudeen]

On Thu, Sep 03, 2026 at 08:34:43AM -0600, Alex Williamson wrote:
> On Thu,  3 Sep 2026 09:30:49 +0530
> Mohamad Raizudeen <raizudeen.kerneldev@gmail.com> wrote:
> 
> > In nvme_disable_and_flr(), the PCI bar is mapped using
> > NVME_REG_CC + sizeof(cfg) which is (0x14 + 4 = 0x18 bytes)
> > 
> > However, the function later reads the controller status from
> > NVME_REG_CSTS - offset 0x1C, which is outside the mapped 0x18 byte
> > boundary. Reading past the mapped MMIO region is undefined behavior and
> > can return invalid data.
> 
> "Undefined behavior" still seems an overstatement.  The code violates
> the API contract, it should be fixed, but it's effectively harmless
> afaict.
>  
> > Fix this by increasing the mapping size to include NVME_REG_CSTS.
> > 
> > Fixes: ffb0863426eb9 ("PCI: Disable Samsung SM961/PM961 NVMe before
> > FLR") Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
> > ---
> > Changes in v2:
> > - Changed the commit message to avoid overstating the risk as pointed
> >   out by Alex Williamson, to be more accurate about the actual
> > behavior.
> > 
> >  drivers/pci/quirks.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
> > index b09f27f7846f..ed03892cc960 100644
> > --- a/drivers/pci/quirks.c
> > +++ b/drivers/pci/quirks.c
> > @@ -4090,7 +4090,7 @@ static int nvme_disable_and_flr(struct pci_dev
> > *dev, bool probe) if (probe)
> >  		return 0;
> >  
> > -	bar = pci_iomap(dev, 0, NVME_REG_CC + sizeof(cfg));
> > +	bar = pci_iomap(dev, 0, NVME_REG_CSTS + sizeof(cfg));
> >  	if (!bar)
> >  		return -ENOTTY;
> >  
> 
> The cfg variable is no longer related to the mapping size now, it
> happens to be the same size, but this should be sizeof(u32) to avoid
> confusion.  Thanks,
> 
> Alex

Hi Alex,

I will make that change and update the commit message for v3.

Thanks,
Mohamad Raizudeen