[PATCH] HID: amd_sfh: Validate PCI BAR size before mapping

[PATCH] HID: amd_sfh: Validate PCI BAR size before mapping

[syzbot]

From: Slawomir Stepien <sst@poczta.fm>

The amd_sfh driver maps PCI BAR 2 using pcim_iomap_regions() and
subsequently accesses MMIO registers at offsets up to 0x10958 (e.g.,
AMD_P2C_MSG3 at 0x1068C). However, the driver never validates that the BAR
size is large enough to cover these accesses. If the driver is bound to a
device with a smaller BAR 2, this leads to an out-of-bounds memory access
and a page fault during the probe function.

For example, a page fault can occur when reading from privdata->mmio +
AMD_P2C_MSG3 in mp2_select_ops():

  BUG: unable to handle page fault for address: ffffc9000390368c
  PGD 100000067 P4D 100000067 PUD 1012c1067 PMD 105b64067 PTE 0
  Oops: Oops: 0000 [#1] SMP KASAN NOPTI
  RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline]
  RIP: 0010:mp2_select_ops drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:282
  [inline]
  RIP: 0010:amd_mp2_pci_probe+0x337/0x5f0
  drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:487
  Call Trace:
   <TASK>
   local_pci_probe drivers/pci/pci-driver.c:332 [inline]
   pci_call_probe drivers/pci/pci-driver.c:394 [inline]
   __pci_device_probe drivers/pci/pci-driver.c:455 [inline]
   pci_device_probe+0x431/0xc90 drivers/pci/pci-driver.c:489

Fix this by verifying that the length of BAR 2 is at least 128KB before
attempting to map it. Since the maximum accessed offset is 0x10958, and PCI
BAR sizes are powers of 2, any legitimate hardware will have a BAR size of
at least 128KB.

Fixes: 4f567b9f8141 ("SFH: PCIe driver to add support of AMD sensor fusion hub")
Assisted-by: Gemini:gemini-3.7-flash Gemini:gemini-3.1-pro-preview syzbot
Reported-by: syzbot+4eadd4dfe9e66522bae8@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4eadd4dfe9e66522bae8
Link: https://syzkaller.appspot.com/ai_job?id=3bc1c45c-548f-4ab5-8243-d2c8ec321d6c
Signed-off-by: Slawomir Stepien <sst@poczta.fm>

---
diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_common.h b/drivers/hid/amd-sfh-hid/amd_sfh_common.h
index 78f830c13..c0c324565 100644
--- a/drivers/hid/amd-sfh-hid/amd_sfh_common.h
+++ b/drivers/hid/amd-sfh-hid/amd_sfh_common.h
@@ -17,6 +17,8 @@
 #define PCI_DEVICE_ID_AMD_MP2		0x15E4
 #define PCI_DEVICE_ID_AMD_MP2_1_1	0x164A
 
+#define AMD_SFH_MIN_BAR_SIZE		(128 * 1024)
+
 #define AMD_C2P_MSG(regno) (0x10500 + ((regno) * 4))
 #define AMD_P2C_MSG(regno) (0x10680 + ((regno) * 4))
 
diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
index 4b81cebdc..039b6ac32 100644
--- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
+++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
@@ -451,6 +451,16 @@ static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i
 	if (rc)
 		return rc;
 
+	if (!(pci_resource_flags(pdev, 2) & IORESOURCE_MEM)) {
+		dev_err(&pdev->dev, "BAR 2 is not IORESOURCE_MEM\n");
+		return -ENODEV;
+	}
+
+	if (pci_resource_len(pdev, 2) < AMD_SFH_MIN_BAR_SIZE) {
+		dev_err(&pdev->dev, "BAR 2 is too small\n");
+		return -EINVAL;
+	}
+
 	rc = pcim_iomap_regions(pdev, BIT(2), DRIVER_NAME);
 	if (rc)
 		return rc;


base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
-- 
See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
The person who has signed off on the patch is responsible for
addressing comments.
syzbot engineers can be reached at syzkaller@googlegroups.com.

Re: [PATCH] HID: amd_sfh: Validate PCI BAR size before mapping

[Jiri Kosina]

On Thu, 27 Aug 2026, syzbot wrote:

> From: Slawomir Stepien <sst@poczta.fm>
> 
> The amd_sfh driver maps PCI BAR 2 using pcim_iomap_regions() and
> subsequently accesses MMIO registers at offsets up to 0x10958 (e.g.,
> AMD_P2C_MSG3 at 0x1068C). However, the driver never validates that the BAR
> size is large enough to cover these accesses. If the driver is bound to a
> device with a smaller BAR 2, this leads to an out-of-bounds memory access
> and a page fault during the probe function.
> 
> For example, a page fault can occur when reading from privdata->mmio +
> AMD_P2C_MSG3 in mp2_select_ops():
> 
>   BUG: unable to handle page fault for address: ffffc9000390368c
>   PGD 100000067 P4D 100000067 PUD 1012c1067 PMD 105b64067 PTE 0
>   Oops: Oops: 0000 [#1] SMP KASAN NOPTI
>   RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline]
>   RIP: 0010:mp2_select_ops drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:282
>   [inline]
>   RIP: 0010:amd_mp2_pci_probe+0x337/0x5f0
>   drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:487
>   Call Trace:
>    <TASK>
>    local_pci_probe drivers/pci/pci-driver.c:332 [inline]
>    pci_call_probe drivers/pci/pci-driver.c:394 [inline]
>    __pci_device_probe drivers/pci/pci-driver.c:455 [inline]
>    pci_device_probe+0x431/0xc90 drivers/pci/pci-driver.c:489
> 
> Fix this by verifying that the length of BAR 2 is at least 128KB before
> attempting to map it. Since the maximum accessed offset is 0x10958, and PCI
> BAR sizes are powers of 2, any legitimate hardware will have a BAR size of
> at least 128KB.
> 
> Fixes: 4f567b9f8141 ("SFH: PCIe driver to add support of AMD sensor fusion hub")
> Assisted-by: Gemini:gemini-3.7-flash Gemini:gemini-3.1-pro-preview syzbot
> Reported-by: syzbot+4eadd4dfe9e66522bae8@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=4eadd4dfe9e66522bae8
> Link: https://syzkaller.appspot.com/ai_job?id=3bc1c45c-548f-4ab5-8243-d2c8ec321d6c
> Signed-off-by: Slawomir Stepien <sst@poczta.fm>

Basavaraj, can you please review this one as well?

Thanks.

> 
> ---
> diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_common.h b/drivers/hid/amd-sfh-hid/amd_sfh_common.h
> index 78f830c13..c0c324565 100644
> --- a/drivers/hid/amd-sfh-hid/amd_sfh_common.h
> +++ b/drivers/hid/amd-sfh-hid/amd_sfh_common.h
> @@ -17,6 +17,8 @@
>  #define PCI_DEVICE_ID_AMD_MP2		0x15E4
>  #define PCI_DEVICE_ID_AMD_MP2_1_1	0x164A
>  
> +#define AMD_SFH_MIN_BAR_SIZE		(128 * 1024)
> +
>  #define AMD_C2P_MSG(regno) (0x10500 + ((regno) * 4))
>  #define AMD_P2C_MSG(regno) (0x10680 + ((regno) * 4))
>  
> diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
> index 4b81cebdc..039b6ac32 100644
> --- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
> +++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
> @@ -451,6 +451,16 @@ static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i
>  	if (rc)
>  		return rc;
>  
> +	if (!(pci_resource_flags(pdev, 2) & IORESOURCE_MEM)) {
> +		dev_err(&pdev->dev, "BAR 2 is not IORESOURCE_MEM\n");
> +		return -ENODEV;
> +	}
> +
> +	if (pci_resource_len(pdev, 2) < AMD_SFH_MIN_BAR_SIZE) {
> +		dev_err(&pdev->dev, "BAR 2 is too small\n");
> +		return -EINVAL;
> +	}
> +
>  	rc = pcim_iomap_regions(pdev, BIT(2), DRIVER_NAME);
>  	if (rc)
>  		return rc;
> 
> 
> base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
> -- 
> See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
> The person who has signed off on the patch is responsible for
> addressing comments.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
> 

-- 
Jiri Kosina
SUSE Labs

Re: [PATCH] HID: amd_sfh: Validate PCI BAR size before mapping

[Basavaraj Natikar]

On 8/27/2026 12:06 PM, syzbot wrote:
> [You don't often get email from syzbot@kernel.org. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> From: Slawomir Stepien <sst@poczta.fm>
>
> The amd_sfh driver maps PCI BAR 2 using pcim_iomap_regions() and
> subsequently accesses MMIO registers at offsets up to 0x10958 (e.g.,
> AMD_P2C_MSG3 at 0x1068C). However, the driver never validates that the BAR
> size is large enough to cover these accesses. If the driver is bound to a
> device with a smaller BAR 2, this leads to an out-of-bounds memory access
> and a page fault during the probe function.
>
> For example, a page fault can occur when reading from privdata->mmio +
> AMD_P2C_MSG3 in mp2_select_ops():
>
>    BUG: unable to handle page fault for address: ffffc9000390368c
>    PGD 100000067 P4D 100000067 PUD 1012c1067 PMD 105b64067 PTE 0
>    Oops: Oops: 0000 [#1] SMP KASAN NOPTI
>    RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline]
>    RIP: 0010:mp2_select_ops drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:282
>    [inline]
>    RIP: 0010:amd_mp2_pci_probe+0x337/0x5f0
>    drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:487
>    Call Trace:
>     <TASK>
>     local_pci_probe drivers/pci/pci-driver.c:332 [inline]
>     pci_call_probe drivers/pci/pci-driver.c:394 [inline]
>     __pci_device_probe drivers/pci/pci-driver.c:455 [inline]
>     pci_device_probe+0x431/0xc90 drivers/pci/pci-driver.c:489
>
> Fix this by verifying that the length of BAR 2 is at least 128KB before
> attempting to map it. Since the maximum accessed offset is 0x10958, and PCI
> BAR sizes are powers of 2, any legitimate hardware will have a BAR size of
> at least 128KB.
>
> Fixes: 4f567b9f8141 ("SFH: PCIe driver to add support of AMD sensor fusion hub")
> Assisted-by: Gemini:gemini-3.7-flash Gemini:gemini-3.1-pro-preview syzbot
> Reported-by: syzbot+4eadd4dfe9e66522bae8@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=4eadd4dfe9e66522bae8
> Link: https://syzkaller.appspot.com/ai_job?id=3bc1c45c-548f-4ab5-8243-d2c8ec321d6c
> Signed-off-by: Slawomir Stepien <sst@poczta.fm>
>
> ---
> diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_common.h b/drivers/hid/amd-sfh-hid/amd_sfh_common.h
> index 78f830c13..c0c324565 100644
> --- a/drivers/hid/amd-sfh-hid/amd_sfh_common.h
> +++ b/drivers/hid/amd-sfh-hid/amd_sfh_common.h
> @@ -17,6 +17,8 @@
>   #define PCI_DEVICE_ID_AMD_MP2          0x15E4
>   #define PCI_DEVICE_ID_AMD_MP2_1_1      0x164A
>
> +#define AMD_SFH_MIN_BAR_SIZE           (128 * 1024)

Please use SZ_128K instead of the open-coded (128 * 1024), A short comment noting the value
must cover the highest register offset (0x10958) would also help future readers.

With that:
Acked-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>

Thanks,
--
Basavaraj

> +
>   #define AMD_C2P_MSG(regno) (0x10500 + ((regno) * 4))
>   #define AMD_P2C_MSG(regno) (0x10680 + ((regno) * 4))
>
> diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
> index 4b81cebdc..039b6ac32 100644
> --- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
> +++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
> @@ -451,6 +451,16 @@ static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i
>          if (rc)
>                  return rc;
>
> +       if (!(pci_resource_flags(pdev, 2) & IORESOURCE_MEM)) {
> +               dev_err(&pdev->dev, "BAR 2 is not IORESOURCE_MEM\n");
> +               return -ENODEV;
> +       }
> +
> +       if (pci_resource_len(pdev, 2) < AMD_SFH_MIN_BAR_SIZE) {
> +               dev_err(&pdev->dev, "BAR 2 is too small\n");
> +               return -EINVAL;
> +       }
> +
>          rc = pcim_iomap_regions(pdev, BIT(2), DRIVER_NAME);
>          if (rc)
>                  return rc;
>
>
> base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
> --
> See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
> The person who has signed off on the patch is responsible for
> addressing comments.
> syzbot engineers can be reached at syzkaller@googlegroups.com.

Re: [PATCH] HID: amd_sfh: Validate PCI BAR size before mapping

[Slawomir Stepien]

On wrz 11, 2026 21:33, Basavaraj Natikar wrote:
> 
> On 8/27/2026 12:06 PM, syzbot wrote:
> > [You don't often get email from syzbot@kernel.org. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
> > 
> > From: Slawomir Stepien <sst@poczta.fm>
> > 
> > The amd_sfh driver maps PCI BAR 2 using pcim_iomap_regions() and
> > subsequently accesses MMIO registers at offsets up to 0x10958 (e.g.,
> > AMD_P2C_MSG3 at 0x1068C). However, the driver never validates that the BAR
> > size is large enough to cover these accesses. If the driver is bound to a
> > device with a smaller BAR 2, this leads to an out-of-bounds memory access
> > and a page fault during the probe function.
> > 
> > For example, a page fault can occur when reading from privdata->mmio +
> > AMD_P2C_MSG3 in mp2_select_ops():
> > 
> >    BUG: unable to handle page fault for address: ffffc9000390368c
> >    PGD 100000067 P4D 100000067 PUD 1012c1067 PMD 105b64067 PTE 0
> >    Oops: Oops: 0000 [#1] SMP KASAN NOPTI
> >    RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline]
> >    RIP: 0010:mp2_select_ops drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:282
> >    [inline]
> >    RIP: 0010:amd_mp2_pci_probe+0x337/0x5f0
> >    drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:487
> >    Call Trace:
> >     <TASK>
> >     local_pci_probe drivers/pci/pci-driver.c:332 [inline]
> >     pci_call_probe drivers/pci/pci-driver.c:394 [inline]
> >     __pci_device_probe drivers/pci/pci-driver.c:455 [inline]
> >     pci_device_probe+0x431/0xc90 drivers/pci/pci-driver.c:489
> > 
> > Fix this by verifying that the length of BAR 2 is at least 128KB before
> > attempting to map it. Since the maximum accessed offset is 0x10958, and PCI
> > BAR sizes are powers of 2, any legitimate hardware will have a BAR size of
> > at least 128KB.
> > 
> > Fixes: 4f567b9f8141 ("SFH: PCIe driver to add support of AMD sensor fusion hub")
> > Assisted-by: Gemini:gemini-3.7-flash Gemini:gemini-3.1-pro-preview syzbot
> > Reported-by: syzbot+4eadd4dfe9e66522bae8@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=4eadd4dfe9e66522bae8
> > Link: https://syzkaller.appspot.com/ai_job?id=3bc1c45c-548f-4ab5-8243-d2c8ec321d6c
> > Signed-off-by: Slawomir Stepien <sst@poczta.fm>
> > 
> > ---
> > diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_common.h b/drivers/hid/amd-sfh-hid/amd_sfh_common.h
> > index 78f830c13..c0c324565 100644
> > --- a/drivers/hid/amd-sfh-hid/amd_sfh_common.h
> > +++ b/drivers/hid/amd-sfh-hid/amd_sfh_common.h
> > @@ -17,6 +17,8 @@
> >   #define PCI_DEVICE_ID_AMD_MP2          0x15E4
> >   #define PCI_DEVICE_ID_AMD_MP2_1_1      0x164A
> > 
> > +#define AMD_SFH_MIN_BAR_SIZE           (128 * 1024)
> 
> Please use SZ_128K instead of the open-coded (128 * 1024), A short comment noting the value
> must cover the highest register offset (0x10958) would also help future readers.
> 
> With that:
> Acked-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>

Sure, will send v2, thanks!

-- 
Slawomir Stepien