linux-kernel - [PATCH] PCI: Test for bit underflow in pcie_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250905052836.work.425-kees@kernel.org>
Date: Thu,  4 Sep 2025 22:28:41 -0700
From: Kees Cook <kees@...nel.org>
To: Bjorn Helgaas <bhelgaas@...gle.com>
Cc: Kees Cook <kees@...nel.org>,
	Linux Kernel Functional Testing <lkft@...aro.org>,
	Anders Roxell <anders.roxell@...aro.org>,
	Naresh Kamboju <naresh.kamboju@...aro.org>,
	lkft-triage@...ts.linaro.org,
	Linux Regressions <regressions@...ts.linux.dev>,
	Arnd Bergmann <arnd@...db.de>,
	Dan Carpenter <dan.carpenter@...aro.org>,
	Ben Copeland <benjamin.copeland@...aro.org>,
	linux-pci@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	"Peter Zijlstra (Intel)" <peterz@...radead.org>,
	linux-hardening@...r.kernel.org
Subject: [PATCH] PCI: Test for bit underflow in pcie_set_readrq()

After commit cbc654d18d37 ("bitops: Add __attribute_const__ to generic
ffs()-family implementations"), which allows GCC's value range tracker
to see past ffs(), GCC 8 on ARM thinks that it might be possible that
"ffs(rq) - 8" used here:

	v = FIELD_PREP(PCI_EXP_DEVCTL_READRQ, ffs(rq) - 8);

could wrap below 0, leading to a very large value, which would be out of
range for the FIELD_PREP() usage:

drivers/pci/pci.c: In function 'pcie_set_readrq':
include/linux/compiler_types.h:572:38: error: call to '__compiletime_assert_471' declared with attribute error: FIELD_PREP: value too large for the field
...
drivers/pci/pci.c:5896:6: note: in expansion of macro 'FIELD_PREP'
  v = FIELD_PREP(PCI_EXP_DEVCTL_READRQ, ffs(rq) - 8);
      ^~~~~~~~~~

If the result of the ffs() is bounds checked before being used in
FIELD_PREP(), the value tracker seems happy again. :)

Fixes: cbc654d18d37 ("bitops: Add __attribute_const__ to generic ffs()-family implementations")
Reported-by: Linux Kernel Functional Testing <lkft@...aro.org>
Closes: https://lore.kernel.org/linux-pci/CA+G9fYuysVr6qT8bjF6f08WLyCJRG7aXAeSd2F7=zTaHHd7L+Q@mail.gmail.com/
Signed-off-by: Kees Cook <kees@...nel.org>
---
Cc: Bjorn Helgaas <bhelgaas@...gle.com>
Cc: Anders Roxell <anders.roxell@...aro.org>
Cc: Naresh Kamboju <naresh.kamboju@...aro.org>
Cc: lkft-triage@...ts.linaro.org
Cc: Linux Regressions <regressions@...ts.linux.dev>
Cc: Arnd Bergmann <arnd@...db.de>
Cc: Dan Carpenter <dan.carpenter@...aro.org>
Cc: Ben Copeland <benjamin.copeland@...aro.org>
Cc: <lkft-triage@...ts.linaro.org>
Cc: <linux-pci@...r.kernel.org>
Cc: <linux-kernel@...r.kernel.org>
---
 drivers/pci/pci.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index b0f4d98036cd..005b92e6585e 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -5932,6 +5932,7 @@ int pcie_set_readrq(struct pci_dev *dev, int rq)
 {
 	u16 v;
 	int ret;
+	unsigned int firstbit;
 	struct pci_host_bridge *bridge = pci_find_host_bridge(dev->bus);
 
 	if (rq < 128 || rq > 4096 || !is_power_of_2(rq))
@@ -5949,7 +5950,10 @@ int pcie_set_readrq(struct pci_dev *dev, int rq)
 			rq = mps;
 	}
 
-	v = FIELD_PREP(PCI_EXP_DEVCTL_READRQ, ffs(rq) - 8);
+	firstbit = ffs(rq);
+	if (firstbit < 8)
+		return -EINVAL;
+	v = FIELD_PREP(PCI_EXP_DEVCTL_READRQ, firstbit - 8);
 
 	if (bridge->no_inc_mrrs) {
 		int max_mrrs = pcie_get_readrq(dev);
-- 
2.34.1