[PATCH] HID: amd_sfh: Validate BAR 2 as memory-mapped I/O in probe
Preetam Sundar Das <[email protected]>
| Newsgroups | org.kernel.vger.linux-input,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
Syzbot reported a page fault in amd_mp2_pci_probe(). The fuzzer creates
a malicious PCI device where BAR 2 is defined as an I/O port rather
than a memory-mapped I/O (MMIO) region.
The driver previously assumed BAR 2 would always be MMIO and blindly
passed the I/O port address to readl(), causing a fatal page fault
when the CPU attempted to read from restricted memory.
Fix this by explicitly checking the PCI resource flags after waking
the device. If BAR 2 is not an IORESOURCE_MEM region, safely reject
the device with -EINVAL to prevent the panic.
Fixes: 4f567b9f8141 ("SFH: PCIe driver to add support of AMD sensor fusion hub")
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?id=227a9acbe565367eb7a1277b47115df8706d9a12
Signed-off-by: Preetam Sundar Das <[email protected]>
---
drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
index 4b81cebdc335..aef105a81570 100644
--- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
+++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
@@ -451,6 +451,9 @@ static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i
if (rc)
return rc;
+ if (!(pci_resource_flags(pdev, 2) & IORESOURCE_MEM))
+ return -EINVAL;
+
rc = pcim_iomap_regions(pdev, BIT(2), DRIVER_NAME);
if (rc)
return rc;
--
2.43.0