Re: [PATCH v2] PCI: sysfs: Reject unaligned resource I/O port accesses

[David Laight <david.laight.linux@gmail.com>]

On Sun, 18 Oct 2026 16:30:19 +0530
Deepanshu Kartikey <kartikey406@gmail.com> wrote:

> On Mon, Sep 28, 2026 at 6:00 PM Deepanshu Kartikey
> <kartikey406@gmail.com> wrote:
> >
> > pci_resource_io() validates that the requested port lies within the
> > BAR but never checks that it is aligned to the access size. A
> > pwrite64()/pread64() on a resourceN file with an odd offset and
> > count=2 or count=4 reaches outw()/outl() with a misaligned address.
> > On arm64 this becomes a store/load to a Device-memory mapping
> > (PCI_IOBASE + port), which architecturally requires natural
> > alignment, causing an alignment fault and kernel oops.
> >
> > Reject misaligned 2- and 4-byte accesses before they reach the
> > low-level accessor. With natural alignment enforced, an access that
> > starts inside the BAR cannot extend past its end, so drop the
> > port + count - 1 range check.
> >
> > Reported-by: syzbot+7134530b25073b4ef373@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=7134530b25073b4ef373
> > Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> > ---
> > v2: Check alignment per access size in the case 2/case 4 branches
> >     instead of using IS_ALIGNED() with a user-controlled count, and
> >     drop the now-redundant port + count - 1 range check.
> >     (Bjorn, David, sashiko)
> > ---
> >  drivers/pci/pci-sysfs.c | 7 ++++---
> >  1 file changed, 4 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
> > index 1f21856aac8a..8118cc6b3a61 100644
> > --- a/drivers/pci/pci-sysfs.c
> > +++ b/drivers/pci/pci-sysfs.c
> > @@ -1209,9 +1209,6 @@ static ssize_t pci_resource_io(struct file *filp, struct kobject *kobj,
> >         if (port > pci_resource_end(pdev, bar))
> >                 return 0;
> >
> > -       if (port + count - 1 > pci_resource_end(pdev, bar))
> > -               return -EINVAL;
> > -
> >         switch (count) {
> >         case 1:
> >                 if (write)
> > @@ -1220,12 +1217,16 @@ static ssize_t pci_resource_io(struct file *filp, struct kobject *kobj,
> >                         *(u8 *)buf = inb(port);
> >                 return 1;
> >         case 2:
> > +               if (port & 1)
> > +                       return -EINVAL;
> >                 if (write)
> >                         outw(*(u16 *)buf, port);
> >                 else
> >                         *(u16 *)buf = inw(port);
> >                 return 2;
> >         case 4:
> > +               if (port & 3)
> > +                       return -EINVAL;
> >                 if (write)
> >                         outl(*(u32 *)buf, port);
> >                 else
> > --
> > 2.43.0
> >  
> 
> Hi David,
> 
> Gentle Reminder. Please let me know the status of this patch.

You need to prod the relevant maintainer, not me.

David

> 
> Thanks
> 
> Deepanshu