From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DFABD6070F12 for ; Wed, 4 Nov 2026 19:19:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=irnDobue; dkim=pass (2048-bit key, unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=hz+Hi3BA DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: Content-Type:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:Cc: To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=0oFqdYtQQ93hmf66Xu9P3kJmoMCkLJeiEqd5UgVqoAA=; b=irnDobue7Pq8IB uTA3j/+cxT0czQAl2IHqjWv6Wj2Yf0VXdVkk1PFpLhGsR9bDo7qk8GnqJOJlvkbX9roq8THnJhLva LWVXI9UmEYtxz5ovkYj0lqC/A6lwemMIao6f0C/Zw93L/p2+jHT87VUCEcdlDa6CprToTX6ZFs7I6 bbWeB0gzIq9dMVTsavoU/5CcSiYk6Np0gvKQcLqGjRyZek4wdGK6zO4vCboSQ7YXTaNdu4iFqWTDa LKZVN9X8Fz52opt2QhTpWWOaFvOsv4lRWerPp8aDW7Xl00UvOGEj8MlCjUuNX2tFERjeXlLTgi4VH 0PYG3+n7wm9uqy1QjrHg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.100.1 #2 (Red Hat Linux)) id 1xOgWa-00000006Z0E-1X98; Wed, 04 Nov 2026 19:19:56 +0000 Received: from tor.source.kernel.org ([2600:3c04:e001:324:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.100.1 #2 (Red Hat Linux)) id 1xOgWX-00000006YzB-2zyR; Wed, 04 Nov 2026 19:19:53 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id 2A7CE60A86; Wed, 4 Nov 2026 19:19:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 00FB41F00A20; Wed, 4 Nov 2026 19:19:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1793819992; bh=0oFqdYtQQ93hmf66Xu9P3kJmoMCkLJeiEqd5UgVqoAA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=hz+Hi3BAL89sr/lh4dJvgeuEtclyRy1SO0NwI+zM8ybFv2jV939+Dv5j/nFojjivC 34KWZ812aeES23dMGvAnt3ycz/SqajABSGrcdN3MX9xaOrork7AxoU/7QteXfxvHfl /V4rWTo2CoC5Jzjt8ZGo2GAXtUIc69Tn9FoUURbwhYdsskX97AesbdGMm73a/kHJmu TWwsRNLr3d8FIdQP7kWnDBE0CbOSCCNE5mAI3+7DlKk2UgHvWoVbDBDqf4bqYXIQ1F 1/2Tfi4Gd8xeoe7KjATEoAV/9UDvE75iATYms6WdPb3WRBuJ8ZphmbEUZbFmU49bNO mp7Eo0gjrTdqA== From: Christian Brauner To: linux-fsdevel@vger.kernel.org Cc: Linus Torvalds , Jann Horn , Josef Bacik , Chris Mason , Jeff Layton , NeilBrown , Eric Dumazet , Thomas Gleixner , Al Viro , Jonathan Corbet , Christoph Hellwig , Greg Kroah-Hartman , Joel Granados , Kees Cook , Jan Kara , Jan Kara , linux-kernel@vger.kernel.org, linux-nfs@vger.kernel.org, linux-acpi@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-s390@vger.kernel.org, linux-scsi@vger.kernel.org, linux-um@lists.infradead.org, linux-wireless@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, netdev@vger.kernel.org, ntfs3@lists.linux.dev, platform-driver-x86@vger.kernel.org, coreteam@netfilter.org, kexec@lists.infradead.org, linux-pci@vger.kernel.org, linux-sound@vger.kernel.org, netfilter-devel@vger.kernel.org, dri-devel@lists.freedesktop.org, ibm-acpi-devel@lists.sourceforge.net, jfs-discussion@lists.sourceforge.net, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-cifs@vger.kernel.org, linux-fbdev@vger.kernel.org, linux-hwmon@vger.kernel.org, linux-mm@kvack.org, linux-sh@vger.kernel.org, linux-usb@vger.kernel.org, samba-technical@lists.samba.org, sparclinux@vger.kernel.org, linux-m68k@lists.linux-m68k.org, linux-doc@vger.kernel.org, linux-serial@vger.kernel.org, linux-atm-general@lists.sourceforge.net, Takashi Iwai , linux-input@vger.kernel.org, linux-raid@vger.kernel.org, linux-ext4@vger.kernel.org, linux-modules@vger.kernel.org, linux-debuggers@vger.kernel.org, "Christian Brauner (Amutable)" , Chuck Lever , stable@vger.kernel.org Subject: [PATCH RESEND v2 15/51] PCI/proc: don't truncate the position of config space accesses Date: Wed, 4 Nov 2026 20:19:38 +0100 Message-ID: <20261104-work-procfs-bugfixes-v2-15-021c84d852e0@kernel.org> In-Reply-To: <20261104-work-procfs-bugfixes-v2-0-021c84d852e0@kernel.org> References: <20261104-work-procfs-bugfixes-v2-0-021c84d852e0@kernel.org> X-Archived-By: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" X-Mailer: b4 0.17-dev X-Developer-Signature: v=1; a=openpgp-sha256; l=2714; i=brauner@kernel.org; h=from:subject:message-id; bh=57Zv3BgjxHPYJgAYtfWWUhWCD6jzurA4v7Zp2iJg+04=; b=owGbwMvMwCU28Zj0gdSKO4sYT6slMWS9brzb+9rGxHjWvh7zmt3Cx6bFvVAJkBPctFNvxnKOf apBXbbyHaUsDGJcDLJiiiwO7Sbhcst5KjYbZWrAzGFlAhnCwMUpABNRf8Twz2qLtYhEpvbj94Wu aQbrKrb8tHnS1sSutCx7f+mETxuYtRn+Cnk3vJkpqGW+cuXUS7IR5159W7FMY03xNO+3W9a/8tV 5zgYA X-Developer-Key: i=brauner@kernel.org; a=openpgp; fpr=4880B8C9BD0E5106FC070F4F7B3C391EFEA93624 Content-Transfer-Encoding: 8bit X-BeenThere: linux-um@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-um" X-Spam-Status: No, score=-18.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=4.0.1 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on aws-us-west-2-korg-listserv-alma10-1 proc_bus_pci_write() truncates the file position to an int. A pwrite() at an offset like 0xfffff000 turns it negative, the check against the size of the config space passes and the count it clamps to ends up larger than what was written. The loop then reads past the end of the caller's buffer and writes all of it into config space at negative offsets, which pci_user_write_config_*() pass on to the config accessors unchecked. The write also returns more than it was asked to write. An offset above 4G that truncates to a small positive value writes to the start of config space instead. proc_bus_pci_read() keeps the position in an unsigned int, so a read at such an offset returns the start of config space instead of hitting EOF. Check the position against the size of the config space before narrowing it. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Christian Brauner (Amutable) --- drivers/pci/proc.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c index 3d7a9ed5fc22..e0dc70123f82 100644 --- a/drivers/pci/proc.c +++ b/drivers/pci/proc.c @@ -32,8 +32,7 @@ static ssize_t proc_bus_pci_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos) { struct pci_dev *dev = pde_data(file_inode(file)); - unsigned int pos = *ppos; - unsigned int cnt, size; + unsigned int pos, cnt, size; /* * Normal users can read only the standardized portion of the @@ -51,8 +50,9 @@ static ssize_t proc_bus_pci_read(struct file *file, char __user *buf, if (!nbytes) return 0; - if (pos >= size) + if (*ppos >= size) return 0; + pos = *ppos; if (nbytes >= size) nbytes = size; if (pos + nbytes > size) @@ -119,9 +119,8 @@ static ssize_t proc_bus_pci_write(struct file *file, const char __user *buf, { struct inode *ino = file_inode(file); struct pci_dev *dev = pde_data(ino); - int pos = *ppos; int size = dev->cfg_size; - int cnt, ret; + int pos, cnt, ret; ret = security_locked_down(LOCKDOWN_PCI_ACCESS); if (ret) @@ -130,14 +129,16 @@ static ssize_t proc_bus_pci_write(struct file *file, const char __user *buf, if (!nbytes) return 0; + if (*ppos >= size) + return 0; + pos = *ppos; + if (resource_is_exclusive(&dev->driver_exclusive_resource, pos, nbytes)) { pci_warn_once(dev, "%s: Unexpected write to kernel-exclusive config offset %x", current->comm, pos); add_taint(TAINT_USER, LOCKDEP_STILL_OK); } - if (pos >= size) - return 0; if (nbytes >= size) nbytes = size; if (pos + nbytes > size) -- 2.53.0