[BUG] ish_hw_start -- page fault on a PIO cookie: intel_ish_ipc maps an I/O BAR and dereferences it

[BUG] ish_hw_start -- page fault on a PIO cookie: intel_ish_ipc maps an I/O BAR and dereferences it

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/152-hid-intel-ish-ioport-bar-deref/

  BUG: unable to handle page fault for address: 000000000001c078
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  Oops: Oops: 0000 [#1] SMP KASAN NOPTI
  RIP: 0010:ish_hw_start+0x41/0x2d0
  Call Trace:
   <TASK>
   ish_probe+0x34d/0x460
   pci_device_probe+0x436/0xc90
   really_probe+0x267/0xaf0
   __driver_probe_device+0x1e2/0x350
   driver_probe_device+0x4f/0x240
   __device_attach_driver+0x270/0x410
   bus_for_each_drv+0x258/0x2f0
   __device_attach+0x2c5/0x450
   drivers_probe_store+0x11c/0x220

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,

Re: [BUG] ish_hw_start -- page fault on a PIO cookie: intel_ish_ipc maps an I/O BAR and dereferences it

[srinivas pandruvada]

Hi Farhad,

On Thu, 2026-08-27 at 22:36 -0700, Farhad Alemi wrote:
> Hello,
> 
> As part of the kernel research at ASU's SEFCOM
> lab, we hit the crash below. Crash reports can be found here:
> 
>  
> https://github.com/farhad-alemi/public_bug_reports/tree/main/152-hid-intel-ish-ioport-bar-deref/
> 
>   BUG: unable to handle page fault for address: 000000000001c078
>   #PF: supervisor read access in kernel mode
>   #PF: error_code(0x0000) - not-present page
>   Oops: Oops: 0000 [#1] SMP KASAN NOPTI
>   RIP: 0010:ish_hw_start+0x41/0x2d0
>   Call Trace:
>    <TASK>
>    ish_probe+0x34d/0x460
>    pci_device_probe+0x436/0xc90
>    really_probe+0x267/0xaf0
>    __driver_probe_device+0x1e2/0x350
>    driver_probe_device+0x4f/0x240
>    __device_attach_driver+0x270/0x410
>    bus_for_each_drv+0x258/0x2f0
>    __device_attach+0x2c5/0x450
>    drivers_probe_store+0x11c/0x220
> 
> Our reproducer.c is available upon request.
> 
> Happy to test a patch if that would help.

Thanks for reporting.

Please submit a patch.
https://www.kernel.org/doc/html/v4.17/process/submitting-patches.html

Thanks,
Srinivas

> 
> Regards,