[PATCH v2] PCI: quirks: Fix out-of-bounds MMIO read in mellanox_check_broken_intx_masking()

[PATCH v2] PCI: quirks: Fix out-of-bounds MMIO read in mellanox_check_broken_intx_masking()

[Mohamad Raizudeen]

The mellanox_check_broken_intx_masking() function maps 4 bytes of MMIO
memory using ioremap() with a size of 4 bytes, but then reads two 32 bit
values using ioread32be(fw_ver) and ioread32be(fw_ver + 1).

Because fw_ver is a pointer to a 32 bit type, fw_ver + 1 advances the
address by 4 bytes. Reading 4 bytes at offset 4 goes past the mapped 4
byte boundary. This violates the API contract.

Fix this by increasing the mapping size to 8 bytes to safely cover both
32 bits.

Fixes: 1600f62534b7b ("PCI: support INTx masking on ConnectX-4 with firmware x.14.1100+")
Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
---
Changes in v2:
- Fixed a typo in the commit message("ad" -> "and").
- Updated commit message to use "violates the API contract" instead of
  "page fault or kernel panic" to avoid overstating the risk, matching
  the feedback from Alex Williamson on a similar patch.

Link for v1: https://lore.kernel.org/linux-pci/20260827071940.B7CC01F000E9@smtp.kernel.org/T/

 drivers/pci/quirks.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index de9bbccda21f..b30ca4244f14 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3714,7 +3714,7 @@ static void mellanox_check_broken_intx_masking(struct pci_dev *pdev)
 		return;
 	}
 
-	fw_ver = ioremap(pci_resource_start(pdev, 0), 4);
+	fw_ver = ioremap(pci_resource_start(pdev, 0), 8);
 	if (!fw_ver) {
 		pci_warn(pdev, "Can't map ConnectX-4 initialization segment\n");
 		goto out;
-- 
2.53.0

Re: [PATCH v2] PCI: quirks: Fix out-of-bounds MMIO read in mellanox_check_broken_intx_masking()

[Mohamad Raizudeen]

On Sat, Sep 05, 2026 at 09:47:43PM +0530, Mohamad Raizudeen wrote:
> The mellanox_check_broken_intx_masking() function maps 4 bytes of MMIO
> memory using ioremap() with a size of 4 bytes, but then reads two 32 bit
> values using ioread32be(fw_ver) and ioread32be(fw_ver + 1).
> 
> Because fw_ver is a pointer to a 32 bit type, fw_ver + 1 advances the
> address by 4 bytes. Reading 4 bytes at offset 4 goes past the mapped 4
> byte boundary. This violates the API contract.
> 
> Fix this by increasing the mapping size to 8 bytes to safely cover both
> 32 bits.
> 
> Fixes: 1600f62534b7b ("PCI: support INTx masking on ConnectX-4 with firmware x.14.1100+")
> Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
> ---
> Changes in v2:
> - Fixed a typo in the commit message("ad" -> "and").
> - Updated commit message to use "violates the API contract" instead of
>   "page fault or kernel panic" to avoid overstating the risk, matching
>   the feedback from Alex Williamson on a similar patch.
> 
> Link for v1: https://lore.kernel.org/linux-pci/20260827071940.B7CC01F000E9@smtp.kernel.org/T/
> 
>  drivers/pci/quirks.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
> index de9bbccda21f..b30ca4244f14 100644
> --- a/drivers/pci/quirks.c
> +++ b/drivers/pci/quirks.c
> @@ -3714,7 +3714,7 @@ static void mellanox_check_broken_intx_masking(struct pci_dev *pdev)
>  		return;
>  	}
>  
> -	fw_ver = ioremap(pci_resource_start(pdev, 0), 4);
> +	fw_ver = ioremap(pci_resource_start(pdev, 0), 8);
>  	if (!fw_ver) {
>  		pci_warn(pdev, "Can't map ConnectX-4 initialization segment\n");
>  		goto out;
> -- 
> 2.53.0
>
Hi Bjorn, 

Just following up on this patch. Please let me know if you have any
feedback or if further changes are needed.

Thanks,
Mohamad Raizudeen