[BUG] KASAN: wild-memory-access in quirk_amd_nb_node (node bitmap index out of bounds) [fam15h_power] [syzkaller]

Hi,

While fuzzing kernel v7.1 with syzkaller (KASAN) I hit a wild-memory-access during
early init when the AMD Northbridge PCI final quirk runs.

Reproducer summary (attached report):

    BUG: KASAN: wild-memory-access in node_state include/linux/nodemask.h:409
    BUG: KASAN: wild-memory-access in quirk_amd_nb_node+0xbe/0x140
            arch/x86/kernel/quirks.c:557
    Read of size 8 at addr 1fffffff8501e1f0 by task swapper/0/1

Call chain: kernel_init -> kernel_init_freeable -> do_initcalls ->
pci_apply_final_quirks -> pci_fixup_device -> pci_do_fixups ->
quirk_amd_nb_node (PCI device 0000:00:05.0).

Root cause: in quirk_amd_nb_node the node index is built without any range
check:

    node = pcibus_to_node(dev->bus) | (val & 7);
    if (node_online(node))                       // node_state -> test_bit(node, ...)
        set_dev_node(&dev->dev, node);

`node_online(node)` expands to `test_bit(node, node_states[N_ONLINE].bits)`,
using `node` directly as a bit index. When the hardware returns a bogus/large
`(val & 7)` combined with an unmapped `pcibus_to_node`, `node` becomes far
out of `MAX_NUMNODES` and `test_bit` reads beyond the `node_states` bitmap ->
wild-memory-access (read 8 bytes).

The crash report attached below:

BUG: KASAN: wild-memory-access in instrument_atomic_read include/linux/instrumented.h:82 [inline]
BUG: KASAN: wild-memory-access in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
BUG: KASAN: wild-memory-access in node_state include/linux/nodemask.h:409 [inline]
BUG: KASAN: wild-memory-access in quirk_amd_nb_node+0xbe/0x140 arch/x86/kernel/quirks.c:557
Read of size 8 at addr 1fffffff8501e1f0 by task swapper/0/1

CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.1.0 #1 PREEMPT(lazy) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xa2/0xd0 lib/dump_stack.c:120
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
 instrument_atomic_read include/linux/instrumented.h:82 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
 node_state include/linux/nodemask.h:409 [inline]
 quirk_amd_nb_node+0xbe/0x140 arch/x86/kernel/quirks.c:557
 pci_do_fixups drivers/pci/quirks.c:187 [inline]
 pci_fixup_device+0x2f3/0x3d0 drivers/pci/quirks.c:262
 pci_apply_final_quirks+0x7b/0x200 drivers/pci/quirks.c:277
 do_one_initcall+0x142/0x5c0 init/main.c:1392
 do_initcall_level+0xac/0xd0 init/main.c:1454
 do_initcalls+0x59/0xa0 init/main.c:1470
 kernel_init_freeable+0x1d7/0x250 init/main.c:1703
 kernel_init+0x1d/0x1d0 init/main.c:1593
 ret_from_fork+0x319/0x5d0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Regards,
Yang Zi