linux-kernel - Re: [PATCH] PCI: Check BAR index for validity

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250304224203.GA260968@bhelgaas>
Date: Tue, 4 Mar 2025 16:42:03 -0600
From: Bjorn Helgaas <helgaas@...nel.org>
To: Philipp Stanner <phasta@...nel.org>
Cc: Bjorn Helgaas <bhelgaas@...gle.com>, linux-pci@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Bingbu Cao <bingbu.cao@...ux.intel.com>
Subject: Re: [PATCH] PCI: Check BAR index for validity

On Tue, Mar 04, 2025 at 03:31:13PM +0100, Philipp Stanner wrote:
> Many functions in PCI use accessor macros such as pci_resource_len(),
> which take a BAR index. That index, however, is never checked for
> validity, potentially resulting in undefined behavior by overflowing the
> array pci_dev.resource in the macro pci_resource_n().
> 
> Since many users of those macros directly assign the accessed value to
> an unsigned integer, the macros cannot be changed easily anymore to
> return -EINVAL for invalid indexes. Consequently, the problem has to be
> mitigated in higher layers.
> 
> Add pci_bar_index_valid(). Use it where appropriate.
> 
> Reported-by: Bingbu Cao <bingbu.cao@...ux.intel.com>
> Closes: https://lore.kernel.org/all/adb53b1f-29e1-3d14-0e61-351fd2d3ff0d@linux.intel.com/
> Signed-off-by: Philipp Stanner <phasta@...nel.org>

Applied to pci/devres for v6.15, thanks.

I reversed this:

> +static inline bool pci_bar_index_is_valid(int bar)
> +{
> +	if (bar < 0 || bar >= PCI_NUM_RESOURCES)
> +		return false;
> +
> +	return true;
> +}

so the test describes valid indexes, not invalid ones:

  if (bar >= 0 && bar < PCI_NUM_RESOURCES)
    return true;

  return false;