[PATCH] alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()

[PATCH] alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()

[Krzysztof Wilczyński]

pci_legacy_write() in arch/alpha/kernel/pci-sysfs.c passes its arguments
to outb(), outw() and outl() in the wrong order:

  outb(port, val);

The Alpha I/O accessors in arch/alpha/include/asm/io.h take the value
first and the port second:

  extern void outb(u8 b, unsigned long port);

So the port number is written as data to the I/O address taken from the
user-supplied value, and the intended write to the requested port never
happens.

The arguments have been reversed since the file was added, and the
function returns the access size regardless, so the caller sees success
while the requested port is left untouched.

Fixes: 10a0ef39fbd1 ("PCI/alpha: pci sysfs resources")
Cc: stable@vger.kernel.org
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
---
 arch/alpha/kernel/pci-sysfs.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/alpha/kernel/pci-sysfs.c b/arch/alpha/kernel/pci-sysfs.c
index 3048758304b5..354ec5f10ad0 100644
--- a/arch/alpha/kernel/pci-sysfs.c
+++ b/arch/alpha/kernel/pci-sysfs.c
@@ -355,17 +355,17 @@ int pci_legacy_write(struct pci_bus *bus, loff_t port, u32 val, size_t size)
 
 	switch(size) {
 	case 1:
-		outb(port, val);
+		outb(val, port);
 		return 1;
 	case 2:
 		if (port & 1)
 			return -EINVAL;
-		outw(port, val);
+		outw(val, port);
 		return 2;
 	case 4:
 		if (port & 3)
 			return -EINVAL;
-		outl(port, val);
+		outl(val, port);
 		return 4;
 	}
 	return -EINVAL;
-- 
2.54.0

Re: [PATCH] alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()

[Magnus Lindholm]

On Sat, Jun 13, 2026 at 1:24 AM Krzysztof Wilczyński
<kwilczynski@kernel.org> wrote:
>
> pci_legacy_write() in arch/alpha/kernel/pci-sysfs.c passes its arguments
> to outb(), outw() and outl() in the wrong order:
>
>   outb(port, val);
>
> The Alpha I/O accessors in arch/alpha/include/asm/io.h take the value
> first and the port second:
>
>   extern void outb(u8 b, unsigned long port);
>
> So the port number is written as data to the I/O address taken from the
> user-supplied value, and the intended write to the requested port never
> happens.
>
> The arguments have been reversed since the file was added, and the
> function returns the access size regardless, so the caller sees success
> while the requested port is left untouched.
>
> Fixes: 10a0ef39fbd1 ("PCI/alpha: pci sysfs resources")
> Cc: stable@vger.kernel.org
> Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
> ---
>  arch/alpha/kernel/pci-sysfs.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/arch/alpha/kernel/pci-sysfs.c b/arch/alpha/kernel/pci-sysfs.c
> index 3048758304b5..354ec5f10ad0 100644
> --- a/arch/alpha/kernel/pci-sysfs.c
> +++ b/arch/alpha/kernel/pci-sysfs.c
> @@ -355,17 +355,17 @@ int pci_legacy_write(struct pci_bus *bus, loff_t port, u32 val, size_t size)
>
>         switch(size) {
>         case 1:
> -               outb(port, val);
> +               outb(val, port);
>                 return 1;
>         case 2:
>                 if (port & 1)
>                         return -EINVAL;
> -               outw(port, val);
> +               outw(val, port);
>                 return 2;
>         case 4:
>                 if (port & 3)
>                         return -EINVAL;
> -               outl(port, val);
> +               outl(val, port);
>                 return 4;
>         }
>         return -EINVAL;
> --

Krzysztof,

Well spotted, this looks correct to me.

This must have been lingering here unnoticed for quite some time.  The
Alpha outb/outw/outl accessors take the value first and the port second,
so the current pci_legacy_write() argument order is clearly wrong.

I tested this on an AlphaStation DS10 by exercising the PCI legacy_io
sysfs path against the scratch registers of the onboard 16550A UARTs at
0x3f8/0x2f8.  With the fix applied, writes through legacy_io read back
correctly:

  ttyS0 scratch at 0x3ff: 0x5a/0xa5 write/readback passed
  ttyS1 scratch at 0x2ff: 0x5a/0xa5 write/readback passed

For comparison, attempting the same test on the unpatched kernel caused
the machine to hang, which is consistent with the reversed arguments
turning the intended UART scratch-register write into an access to an
unrelated legacy I/O port.

I will pick this up.  It might not make this merge window, but I will try
to get it queued sooner rather than later.

Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>