[PATCH v2] PCI: sysfs: Reject unaligned resource I/O port accesses

[PATCH v2] PCI: sysfs: Reject unaligned resource I/O port accesses

[Deepanshu Kartikey]

pci_resource_io() validates that the requested port lies within the
BAR but never checks that it is aligned to the access size. A
pwrite64()/pread64() on a resourceN file with an odd offset and
count=2 or count=4 reaches outw()/outl() with a misaligned address.
On arm64 this becomes a store/load to a Device-memory mapping
(PCI_IOBASE + port), which architecturally requires natural
alignment, causing an alignment fault and kernel oops.

Reject misaligned 2- and 4-byte accesses before they reach the
low-level accessor. With natural alignment enforced, an access that
starts inside the BAR cannot extend past its end, so drop the
port + count - 1 range check.

Reported-by: syzbot+7134530b25073b4ef373@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7134530b25073b4ef373
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
v2: Check alignment per access size in the case 2/case 4 branches
    instead of using IS_ALIGNED() with a user-controlled count, and
    drop the now-redundant port + count - 1 range check.
    (Bjorn, David, sashiko)
---
 drivers/pci/pci-sysfs.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 1f21856aac8a..8118cc6b3a61 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -1209,9 +1209,6 @@ static ssize_t pci_resource_io(struct file *filp, struct kobject *kobj,
 	if (port > pci_resource_end(pdev, bar))
 		return 0;
 
-	if (port + count - 1 > pci_resource_end(pdev, bar))
-		return -EINVAL;
-
 	switch (count) {
 	case 1:
 		if (write)
@@ -1220,12 +1217,16 @@ static ssize_t pci_resource_io(struct file *filp, struct kobject *kobj,
 			*(u8 *)buf = inb(port);
 		return 1;
 	case 2:
+		if (port & 1)
+			return -EINVAL;
 		if (write)
 			outw(*(u16 *)buf, port);
 		else
 			*(u16 *)buf = inw(port);
 		return 2;
 	case 4:
+		if (port & 3)
+			return -EINVAL;
 		if (write)
 			outl(*(u32 *)buf, port);
 		else
-- 
2.43.0

Re: [PATCH v2] PCI: sysfs: Reject unaligned resource I/O port accesses

[Ilpo Järvinen]

On Mon, 28 Sep 2026, Deepanshu Kartikey wrote:

> pci_resource_io() validates that the requested port lies within the
> BAR but never checks that it is aligned to the access size. A
> pwrite64()/pread64() on a resourceN file with an odd offset and
> count=2 or count=4 reaches outw()/outl() with a misaligned address.
> On arm64 this becomes a store/load to a Device-memory mapping
> (PCI_IOBASE + port), which architecturally requires natural
> alignment, causing an alignment fault and kernel oops.
> 
> Reject misaligned 2- and 4-byte accesses before they reach the
> low-level accessor. With natural alignment enforced, an access that
> starts inside the BAR cannot extend past its end, so drop the
> port + count - 1 range check.
> 
> Reported-by: syzbot+7134530b25073b4ef373@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=7134530b25073b4ef373
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
> v2: Check alignment per access size in the case 2/case 4 branches
>     instead of using IS_ALIGNED() with a user-controlled count, and
>     drop the now-redundant port + count - 1 range check.
>     (Bjorn, David, sashiko)
> ---
>  drivers/pci/pci-sysfs.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
> index 1f21856aac8a..8118cc6b3a61 100644
> --- a/drivers/pci/pci-sysfs.c
> +++ b/drivers/pci/pci-sysfs.c
> @@ -1209,9 +1209,6 @@ static ssize_t pci_resource_io(struct file *filp, struct kobject *kobj,
>  	if (port > pci_resource_end(pdev, bar))
>  		return 0;
>  
> -	if (port + count - 1 > pci_resource_end(pdev, bar))
> -		return -EINVAL;
> -
>  	switch (count) {
>  	case 1:
>  		if (write)
> @@ -1220,12 +1217,16 @@ static ssize_t pci_resource_io(struct file *filp, struct kobject *kobj,
>  			*(u8 *)buf = inb(port);
>  		return 1;
>  	case 2:
> +		if (port & 1)
> +			return -EINVAL;
>  		if (write)
>  			outw(*(u16 *)buf, port);
>  		else
>  			*(u16 *)buf = inw(port);
>  		return 2;
>  	case 4:
> +		if (port & 3)

Why fon't these use !IS_ALIGNED() anymore? You can use e.g. sizeof() to 
connect it to the natural alignment of the type so you don't have to use 
literals at all.

> +			return -EINVAL;
>  		if (write)
>  			outl(*(u32 *)buf, port);
>  		else
> 

-- 
 i.

Re: [PATCH v2] PCI: sysfs: Reject unaligned resource I/O port accesses

[David Laight]

On Mon, 28 Sep 2026 15:57:23 +0300 (EEST)
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> wrote:

> On Mon, 28 Sep 2026, Deepanshu Kartikey wrote:
> 
> > pci_resource_io() validates that the requested port lies within the
> > BAR but never checks that it is aligned to the access size. A
> > pwrite64()/pread64() on a resourceN file with an odd offset and
> > count=2 or count=4 reaches outw()/outl() with a misaligned address.
> > On arm64 this becomes a store/load to a Device-memory mapping
> > (PCI_IOBASE + port), which architecturally requires natural
> > alignment, causing an alignment fault and kernel oops.
> > 
> > Reject misaligned 2- and 4-byte accesses before they reach the
> > low-level accessor. With natural alignment enforced, an access that
> > starts inside the BAR cannot extend past its end, so drop the
> > port + count - 1 range check.
> > 
> > Reported-by: syzbot+7134530b25073b4ef373@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=7134530b25073b4ef373
> > Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> > ---
> > v2: Check alignment per access size in the case 2/case 4 branches
> >     instead of using IS_ALIGNED() with a user-controlled count, and
> >     drop the now-redundant port + count - 1 range check.
> >     (Bjorn, David, sashiko)
> > ---
> >  drivers/pci/pci-sysfs.c | 7 ++++---
> >  1 file changed, 4 insertions(+), 3 deletions(-)
> > 
> > diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
> > index 1f21856aac8a..8118cc6b3a61 100644
> > --- a/drivers/pci/pci-sysfs.c
> > +++ b/drivers/pci/pci-sysfs.c
> > @@ -1209,9 +1209,6 @@ static ssize_t pci_resource_io(struct file *filp, struct kobject *kobj,
> >  	if (port > pci_resource_end(pdev, bar))
> >  		return 0;
> >  
> > -	if (port + count - 1 > pci_resource_end(pdev, bar))
> > -		return -EINVAL;
> > -
> >  	switch (count) {
> >  	case 1:
> >  		if (write)
> > @@ -1220,12 +1217,16 @@ static ssize_t pci_resource_io(struct file *filp, struct kobject *kobj,
> >  			*(u8 *)buf = inb(port);
> >  		return 1;
> >  	case 2:
> > +		if (port & 1)
> > +			return -EINVAL;
> >  		if (write)
> >  			outw(*(u16 *)buf, port);
> >  		else
> >  			*(u16 *)buf = inw(port);
> >  		return 2;
> >  	case 4:
> > +		if (port & 3)  
> 
> Why fon't these use !IS_ALIGNED() anymore? You can use e.g. sizeof() to 
> connect it to the natural alignment of the type so you don't have to use 
> literals at all.

That just obfuscates what is going on....

David

> 
> > +			return -EINVAL;
> >  		if (write)
> >  			outl(*(u32 *)buf, port);
> >  		else
> >   
>