From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 78BC931A7EA for ; Sat, 4 Apr 2026 08:53:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775292796; cv=none; b=hIZuID3SS6NnoYNUiB9tfGRx0uehr3s+2qGmiotScv79VrrxhOZ66qWwwZ8X1yY9zRNUy6q51kZNfOYYsjZkb3bp7v54XNTzlMbaWol6lDtMaxItgEN4phoKw1WwqbVCseis1m5GIhuegKXh0pgmk0x7rXelvWWqCIPc3BKKRgQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775292796; c=relaxed/simple; bh=9OJ4UNKQcRb8Ws8QLo61/dvK/QzgaBZThrXn5UYtEf8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=EFN4DAHEslUTwNg/oGmAJW5BG9RAYzbd1Ll9TF8tlYdmhDdQWO4mMLtF5JFwxcu4takwGlVUiwS3nckEg908tiEnqF1PMdrSOKDag9zkGnkViwYdgBCv5OW/1PxlehsiwPW9w44Kblr4cpVmxWGeDr4juU7V/J1d27NoiToXPvQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=m70sZ2tN; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=iJfLKY3w; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="m70sZ2tN"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="iJfLKY3w" Received: from pps.filterd (m0279863.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6343Zfrs1873008 for ; Sat, 4 Apr 2026 08:53:15 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= euurnDdp2gg95lsunKzyUav3a4dM9U326nl7pdJ2T68=; b=m70sZ2tN0SNU37Zx LwlhVXTw8AEzLK6eDxWuy8FKGfignt3zfYfb8EgicZDPXmVGi43xJUfnRGfap0iK oAgPobK6Ix8Igb0LfcjBRcG4GG5X94cr91Q7YOGn1ncnZ1nSY8X1ak6nMvqKe/XP IeDPnLZQ6OwUZ16ODSSE7F2x3EpY/gbIMy8xAqvISQ/qr4eYfS+zUrrVbDCIosPt 64TyLsVl3o4vSGzya/x46Gvr75pGvrVOwB2lAq9SuRGbMaeAP7DPYDW/UkHP512R TxM6L/Y/OPtP+UiREgRHvrq+ZK07SCgd2NX32Xc0zQyJ+Prdh1+XWOyuYxZLRJ3I 75hxsQ== Received: from mail-pl1-f197.google.com (mail-pl1-f197.google.com [209.85.214.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4datv18gxk-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Sat, 04 Apr 2026 08:53:14 +0000 (GMT) Received: by mail-pl1-f197.google.com with SMTP id d9443c01a7336-2b23c909256so36936735ad.0 for ; Sat, 04 Apr 2026 01:53:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1775292794; x=1775897594; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=euurnDdp2gg95lsunKzyUav3a4dM9U326nl7pdJ2T68=; b=iJfLKY3waIjvvJgHDFHO2itJp7X/Pk28sMAyjE0Qf7pPVI9mlqggLdgTPkod3gNVZl YZaQFzuo0hcP0ZFCQNiyQCiyIBtcDBgCSKeqHjvP0u+kRLUIS95o6lDNhoHgn0scWQSu EZ9oxPgfLOoco6bVv7/EkM8sCI6sPd+7K1ZuMlqGUsncp5vEs4OtH9A3WYyhrTqjFjLE lUqAfUi4Nx3kxORgKJ9LeQg3bb0SCaAiORz5zOPnwmXbGANs054xCK+dgZnPGoF3mZaR PWE/WT9OQkhxh7maa+m3bf+aGNBJFdQjk/8BKwClB49g9PIEFZlALYuPWJpq/tg7Rp13 R3PQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775292794; x=1775897594; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=euurnDdp2gg95lsunKzyUav3a4dM9U326nl7pdJ2T68=; b=Dmb2eg4uZcVfERhTorSaoKYd7T1sQ+CbuQeAaY7S7/HMUD8Hh1RnGjThU6/baTYbN4 jYEx5t7+gdhmL/sHVRMzi8on2rPrbUqX5rxJcY46UYoSKDhxV9SE3Cxl6bSIM8ABeDHE F5Mov0DocGf1MUXqQXY2Sp+7JK1in1F5eFwYrw9mIuI+T/ik6h0u4zz92mjcbkIfj7P9 ukPPVG0wYIcHpuE6Txqu6ka89N0dkEEMLY4Egr1ZPScIoNrEr/n65YlZAy3GDT4om1Go D7FoziLJKCQkZGQ8uncRQb79d3rNqEqPRG840SLFLFBhyqe4wvY96oc/s18SvbgmBGiY 51vw== X-Forwarded-Encrypted: i=1; AJvYcCVg/YPfqNyV8DYUgobPLZL2bsd1OouX7ZlNbriGc1xKGzFB64PPXUttv7NahvIUlydqD7GmHKWuVC7gjDE=@vger.kernel.org X-Gm-Message-State: AOJu0YyHdWao3SyO0wHpGaCKo6o1bRkvbH19ixHExqsCJ6d69f9Qolbs nMAGH9aBy0e/PhKnnSMHMgDMvUcmoEcZb3EepgyyuS3CoLzcomWai1dAP2lsGiUFB3R6CxMCxiU nHiUUio29z825T5J4glbnoCnxd7wU7PbwBjQJSsE1S1aHWYr35o4n9qnl407+rBd4234= X-Gm-Gg: AeBDiesEGjlKRu7pIhe1oGjg1Q3EVGwz3KkVzVY4VM++ObetFAbPz1c/aZBYRCV4E48 iCYENVzRHnQjwIPMvrKYmXyoa+KKNmDtGG6nJAtJ00GNFcCopvsWT3vjIJnNUwf14Ax4fIPCLv9 ho07qjrMygG05rVezt/16o+ofkTar44Ap1/QQdY2xjOShIgbN8jijEjflA8X9GbJ7uLresATnUi /uBl1oTGxf7ryj3kVevFLSSyhpo1ZaG/3uIZKL8ToMDfHavfD3uAQ55850ESVB/UoKp6ht5l/BN O9uT7TqmXx6WeuBfXrVwduEEGGPaRVEktchsPioSNbK4WwiH81xBOJMk0K2fe9bGJrj0n9lfjDX jAfyOr7Vae/1fE259dU+HoT75XLhShkluZGGx3qdNVaX7rFX0/wTTCzi+ X-Received: by 2002:a17:903:18a:b0:2b0:9c2b:641d with SMTP id d9443c01a7336-2b28164c170mr64609725ad.2.1775292794144; Sat, 04 Apr 2026 01:53:14 -0700 (PDT) X-Received: by 2002:a17:903:18a:b0:2b0:9c2b:641d with SMTP id d9443c01a7336-2b28164c170mr64609525ad.2.1775292793610; Sat, 04 Apr 2026 01:53:13 -0700 (PDT) Received: from hu-krichai-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2b2749e2e97sm106883085ad.82.2026.04.04.01.53.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 04 Apr 2026 01:53:13 -0700 (PDT) From: Krishna Chaitanya Chundru Date: Sat, 04 Apr 2026 14:23:00 +0530 Subject: [PATCH 2/2] PCI: Fix NULL pointer access in pci_store_saved_state() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260404-fix_pci_access-v1-2-416f32c6f7ec@oss.qualcomm.com> References: <20260404-fix_pci_access-v1-0-416f32c6f7ec@oss.qualcomm.com> In-Reply-To: <20260404-fix_pci_access-v1-0-416f32c6f7ec@oss.qualcomm.com> To: Bjorn Helgaas , manivannan.sadhasivam@oss.qualcomm.com Cc: linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Krishna Chaitanya Chundru X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1775292785; l=2834; i=krishna.chundru@oss.qualcomm.com; s=20230907; h=from:subject:message-id; bh=9OJ4UNKQcRb8Ws8QLo61/dvK/QzgaBZThrXn5UYtEf8=; b=YtTtpgacAWIa6+gDdtLCAfY+uvhDy3uUYQ8KKTtVJGF3HsC2IxyafsNdiEwAqgCcH7zPAiSfy YWoi4GOcxT2C8FXP8HmGN2DjGb8ZVujMMY3bMfMJJ1gASRpVQR/yfdW X-Developer-Key: i=krishna.chundru@oss.qualcomm.com; a=ed25519; pk=10CL2pdAKFyzyOHbfSWHCD0X0my7CXxj8gJScmn1FAg= X-Proofpoint-GUID: hbqs7Jf9RLe9hMtW2VLCTGhUKEJifSQc X-Authority-Analysis: v=2.4 cv=GLEF0+NK c=1 sm=1 tr=0 ts=69d0d17a cx=c_pps a=cmESyDAEBpBGqyK7t0alAg==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17 a=IkcTkHD0fZMA:10 a=A5OVakUREuEA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=yOCtJkima9RkubShWh1s:22 a=EUspDBNiAAAA:8 a=SbfQo5s_ALff5BtGSsgA:9 a=QEXdDO2ut3YA:10 a=1OuFwYUASf3TG4hYMiVC:22 X-Proofpoint-ORIG-GUID: hbqs7Jf9RLe9hMtW2VLCTGhUKEJifSQc X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNDA0MDA3OCBTYWx0ZWRfXye0RCrvnNbgw JJOAiN31Npask9mpjrva6lqO6aM9OEiBLKngMdTBEHa/NHvDMLlQfMcGWLvuoUXGZuDub7+QZ2l QqJtjxdz83sFgTtRbEdP25fgkkTCam/Njft24y+V/8XVzaeLRcGtwoW65CdZsHpGvavac+Xh0Ij zuXJMITozEND+wVJFx5gBa76CSFz2khwTuSMWoHqiwGt1LcurhEsd5XCA1ZGj/rUui3ZY3Dy7vB J2+rJJ8TpEXNnVpFKWmDquofdcHlqQRayFmDy1J99j+g3bjkfFYo+3vfL1skoEG2AejDnZH1rGd uTo/qKrhri6NWKIFUkCIEWkZQUglkf4SYKKWvGRqg+IDxcuCA3hNkhtJylW9Yxyzwfd7jhAuiax lUI8181UU79i+Y7+W/lpuYnVSynL84UnLnhMnxAnHnh6trMgvtfW8sSUj8vErp/fPGgpZ3dfOOk uMArUvirdw9AKSsI0Ew== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-04-03_07,2026-04-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 phishscore=0 spamscore=0 suspectscore=0 adultscore=0 priorityscore=1501 clxscore=1015 lowpriorityscore=0 impostorscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2603050001 definitions=main-2604040078 If the PCIe link goes down while pci_save_state() is in progress, reads from the device configuration space may return invalid values(all 0xF's). This can lead to saving corrupted or inconsistent capability state and subsequent memory corruption. The issue is not limited to a specific capability type and may occur at any point during the save process. One example is, while saving VC extended capability save path (pci_save_vc_state() / pci_vc_do_save_buffer()) then interprets all-1s capability fields as valid and ends up writing far beyond the allocated pci_cap_saved_state buffer, corrupting the pci_dev->saved_cap_space list. The call stack of the issue as follows. [ T1634] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000013 [ T1634] Mem abort info: [ T1634] ESR = 0x96000005 [ T1634] EC = 0x25: DABT (current EL), IL = 32 bits [ T1634] SET = 0, FnV = 0 [ T1634] EA = 0, S1PTW = 0 [ T1634] FSC = 0x05: level 1 translation fault [ T1634] Data abort info: [ T1634] ISV = 0, ISS = 0x00000005 [ T1634] CM = 0, WnR = 0 [ T1634] user pgtable: 4k pages, 39-bit VAs, pgdp=00000000ac2ed000 [ T1634] [0000000000000013] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ T1634] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ T1634] Dumping ftrace buffer: [ T1634] (ftrace buffer empty) [ T1634] pc : pci_store_saved_state+0x40/0xd8 [ T1634] lr : cnss_set_pci_config_space+0x54/0x100 [cnss2] [ T1634] Call trace: [ T1634] pci_store_saved_state+0x40/0xd8 [ T1634] cnss_set_pci_config_space+0x54/0x100 [cnss2] Fix this issue by bailing out early from pci_store_saved_state() if link is not active and also make saved_state = false. The link state check here is racy since the link may transition at any time. This is a best-effort attempt to avoid saving PCI state when the link is already down. Signed-off-by: Krishna Chaitanya Chundru --- drivers/pci/pci.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 1488c93d4e22371480165cb55afc7a0c3cae238e..06bd6b7d62ec1a41bd12af2ab47ecd2b77665c7e 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -1875,6 +1875,16 @@ struct pci_saved_state *pci_store_saved_state(struct pci_dev *dev) if (!dev->state_saved) return NULL; + /* + * The link state check here is racy since the link may transition at + * any time. This is a best-effort attempt to avoid saving PCI state + * when the link is already down. + */ + if (!pcie_link_is_active(dev)) { + dev->state_saved = false; + return NULL; + } + size = sizeof(*state) + sizeof(struct pci_cap_saved_data); hlist_for_each_entry(tmp, &dev->saved_cap_space, next) -- 2.34.1