* [PATCH RFC v3] HID: amd_sfh: Validate PCI BAR size before mapping
@ 2026-08-26 9:54 syzbot
2026-08-27 6:35 ` Slawomir Stepien
0 siblings, 1 reply; 2+ messages in thread
From: syzbot @ 2026-08-26 9:54 UTC (permalink / raw)
To: syzkaller-upstream-moderation; +Cc: sst, syzbot
The amd_sfh driver maps PCI BAR 2 using pcim_iomap_regions() and
subsequently accesses MMIO registers at offsets up to 0x10958 (e.g.,
AMD_P2C_MSG3 at 0x1068C). However, the driver never validates that the BAR
size is large enough to cover these accesses. If the driver is bound to a
device with a smaller BAR 2, this leads to an out-of-bounds memory access
and a page fault during the probe function.
For example, a page fault can occur when reading from privdata->mmio +
AMD_P2C_MSG3 in mp2_select_ops():
BUG: unable to handle page fault for address: ffffc9000390368c
PGD 100000067 P4D 100000067 PUD 1012c1067 PMD 105b64067 PTE 0
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline]
RIP: 0010:mp2_select_ops drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:282
[inline]
RIP: 0010:amd_mp2_pci_probe+0x337/0x5f0
drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:487
Call Trace:
<TASK>
local_pci_probe drivers/pci/pci-driver.c:332 [inline]
pci_call_probe drivers/pci/pci-driver.c:394 [inline]
__pci_device_probe drivers/pci/pci-driver.c:455 [inline]
pci_device_probe+0x431/0xc90 drivers/pci/pci-driver.c:489
Fix this by verifying that the length of BAR 2 is at least 128KB before
attempting to map it. Since the maximum accessed offset is 0x10958, and PCI
BAR sizes are powers of 2, any legitimate hardware will have a BAR size of
at least 128KB.
Fixes: 4f567b9f8141 ("SFH: PCIe driver to add support of AMD sensor fusion hub")
Assisted-by: Gemini:gemini-3.7-flash Gemini:gemini-3.1-pro-preview syzbot
Reported-by: syzbot+4eadd4dfe9e66522bae8@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4eadd4dfe9e66522bae8
Link: https://syzkaller.appspot.com/ai_job?id=3bc1c45c-548f-4ab5-8243-d2c8ec321d6c
To: "Basavaraj Natikar" <basavaraj.natikar@amd.com>
To: "Benjamin Tissoires" <bentiss@kernel.org>
To: "Jiri Kosina" <jikos@kernel.org>
To: <linux-input@vger.kernel.org>
To: "Sandeep Singh" <sandeep.singh@amd.com>
Cc: <linux-kernel@vger.kernel.org>
---
v3:
- Check that BAR 2 is an MMIO resource (IORESOURCE_MEM).
- Drop unrelated changes in sfh1_1/amd_sfh_init.c.
v2:
- Define AMD_SFH_MIN_BAR_SIZE macro instead of hardcoded 128 * 1024
- Use AMD_SFH_MIN_BAR_SIZE in amd_sfh1_1_init()
https://lore.kernel.org/all/2d083f63-913d-45c5-b770-c88ee06589ba@mail.kernel.org/T/
v1:
https://lore.kernel.org/all/f83daf97-4762-4a67-bac7-615b34d1b661@mail.kernel.org/T/
---
diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_common.h b/drivers/hid/amd-sfh-hid/amd_sfh_common.h
index 78f830c13..c0c324565 100644
--- a/drivers/hid/amd-sfh-hid/amd_sfh_common.h
+++ b/drivers/hid/amd-sfh-hid/amd_sfh_common.h
@@ -17,6 +17,8 @@
#define PCI_DEVICE_ID_AMD_MP2 0x15E4
#define PCI_DEVICE_ID_AMD_MP2_1_1 0x164A
+#define AMD_SFH_MIN_BAR_SIZE (128 * 1024)
+
#define AMD_C2P_MSG(regno) (0x10500 + ((regno) * 4))
#define AMD_P2C_MSG(regno) (0x10680 + ((regno) * 4))
diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
index 4b81cebdc..039b6ac32 100644
--- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
+++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
@@ -451,6 +451,16 @@ static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i
if (rc)
return rc;
+ if (!(pci_resource_flags(pdev, 2) & IORESOURCE_MEM)) {
+ dev_err(&pdev->dev, "BAR 2 is not IORESOURCE_MEM\n");
+ return -ENODEV;
+ }
+
+ if (pci_resource_len(pdev, 2) < AMD_SFH_MIN_BAR_SIZE) {
+ dev_err(&pdev->dev, "BAR 2 is too small\n");
+ return -EINVAL;
+ }
+
rc = pcim_iomap_regions(pdev, BIT(2), DRIVER_NAME);
if (rc)
return rc;
base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
--
This is an AI-generated patch subject to moderation.
Reply with '#syz upstream' to Sign-off the patch as a human author
and send it to the upstream kernel mailing lists.
Reply with '#syz reject' to reject it ('#syz unreject' to undo).
See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
You can comment on the patch as usual, syzbot will try to address
the comments and send a new version of the patch if necessary.
syzbot engineers can be reached at syzkaller@googlegroups.com.
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH RFC v3] HID: amd_sfh: Validate PCI BAR size before mapping
2026-08-26 9:54 [PATCH RFC v3] HID: amd_sfh: Validate PCI BAR size before mapping syzbot
@ 2026-08-27 6:35 ` Slawomir Stepien
0 siblings, 0 replies; 2+ messages in thread
From: Slawomir Stepien @ 2026-08-27 6:35 UTC (permalink / raw)
To: syzbot; +Cc: syzkaller-upstream-moderation, syzbot
#syz upstream
On sie 26, 2026 09:54, syzbot wrote:
> The amd_sfh driver maps PCI BAR 2 using pcim_iomap_regions() and
> subsequently accesses MMIO registers at offsets up to 0x10958 (e.g.,
> AMD_P2C_MSG3 at 0x1068C). However, the driver never validates that the BAR
> size is large enough to cover these accesses. If the driver is bound to a
> device with a smaller BAR 2, this leads to an out-of-bounds memory access
> and a page fault during the probe function.
>
> For example, a page fault can occur when reading from privdata->mmio +
> AMD_P2C_MSG3 in mp2_select_ops():
>
> BUG: unable to handle page fault for address: ffffc9000390368c
> PGD 100000067 P4D 100000067 PUD 1012c1067 PMD 105b64067 PTE 0
> Oops: Oops: 0000 [#1] SMP KASAN NOPTI
> RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline]
> RIP: 0010:mp2_select_ops drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:282
> [inline]
> RIP: 0010:amd_mp2_pci_probe+0x337/0x5f0
> drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:487
> Call Trace:
> <TASK>
> local_pci_probe drivers/pci/pci-driver.c:332 [inline]
> pci_call_probe drivers/pci/pci-driver.c:394 [inline]
> __pci_device_probe drivers/pci/pci-driver.c:455 [inline]
> pci_device_probe+0x431/0xc90 drivers/pci/pci-driver.c:489
>
> Fix this by verifying that the length of BAR 2 is at least 128KB before
> attempting to map it. Since the maximum accessed offset is 0x10958, and PCI
> BAR sizes are powers of 2, any legitimate hardware will have a BAR size of
> at least 128KB.
>
> Fixes: 4f567b9f8141 ("SFH: PCIe driver to add support of AMD sensor fusion hub")
> Assisted-by: Gemini:gemini-3.7-flash Gemini:gemini-3.1-pro-preview syzbot
> Reported-by: syzbot+4eadd4dfe9e66522bae8@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=4eadd4dfe9e66522bae8
> Link: https://syzkaller.appspot.com/ai_job?id=3bc1c45c-548f-4ab5-8243-d2c8ec321d6c
> To: "Basavaraj Natikar" <basavaraj.natikar@amd.com>
> To: "Benjamin Tissoires" <bentiss@kernel.org>
> To: "Jiri Kosina" <jikos@kernel.org>
> To: <linux-input@vger.kernel.org>
> To: "Sandeep Singh" <sandeep.singh@amd.com>
> Cc: <linux-kernel@vger.kernel.org>
>
> ---
> v3:
> - Check that BAR 2 is an MMIO resource (IORESOURCE_MEM).
> - Drop unrelated changes in sfh1_1/amd_sfh_init.c.
>
> v2:
> - Define AMD_SFH_MIN_BAR_SIZE macro instead of hardcoded 128 * 1024
> - Use AMD_SFH_MIN_BAR_SIZE in amd_sfh1_1_init()
> https://lore.kernel.org/all/2d083f63-913d-45c5-b770-c88ee06589ba@mail.kernel.org/T/
>
> v1:
> https://lore.kernel.org/all/f83daf97-4762-4a67-bac7-615b34d1b661@mail.kernel.org/T/
> ---
> diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_common.h b/drivers/hid/amd-sfh-hid/amd_sfh_common.h
> index 78f830c13..c0c324565 100644
> --- a/drivers/hid/amd-sfh-hid/amd_sfh_common.h
> +++ b/drivers/hid/amd-sfh-hid/amd_sfh_common.h
> @@ -17,6 +17,8 @@
> #define PCI_DEVICE_ID_AMD_MP2 0x15E4
> #define PCI_DEVICE_ID_AMD_MP2_1_1 0x164A
>
> +#define AMD_SFH_MIN_BAR_SIZE (128 * 1024)
> +
> #define AMD_C2P_MSG(regno) (0x10500 + ((regno) * 4))
> #define AMD_P2C_MSG(regno) (0x10680 + ((regno) * 4))
>
> diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
> index 4b81cebdc..039b6ac32 100644
> --- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
> +++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
> @@ -451,6 +451,16 @@ static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i
> if (rc)
> return rc;
>
> + if (!(pci_resource_flags(pdev, 2) & IORESOURCE_MEM)) {
> + dev_err(&pdev->dev, "BAR 2 is not IORESOURCE_MEM\n");
> + return -ENODEV;
> + }
> +
> + if (pci_resource_len(pdev, 2) < AMD_SFH_MIN_BAR_SIZE) {
> + dev_err(&pdev->dev, "BAR 2 is too small\n");
> + return -EINVAL;
> + }
> +
> rc = pcim_iomap_regions(pdev, BIT(2), DRIVER_NAME);
> if (rc)
> return rc;
>
>
> base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
--
Slawomir Stepien
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-08-27 6:35 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-26 9:54 [PATCH RFC v3] HID: amd_sfh: Validate PCI BAR size before mapping syzbot
2026-08-27 6:35 ` Slawomir Stepien
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox