[PATCH] PCI: quirks: Fix out-of-bounds MMIO read in nvme_disable_and_flr()
Mohamad Raizudeen <[email protected]>
| Newsgroups | org.kernel.vger.linux-kernel,org.kernel.vger.linux-pci |
|---|---|
| Message-ID | <[email protected]> |
In nvme_disable_and_flr(), the PCI bar is mapped using
NVME_REG_CC + sizeof(cfg) which is (0x14 + 4 = 0x18 bytes)
However, the function later reads the controller status from
NVME_REG_CSTS - offset 0x1C, which is outside the mapped 0x18 byte
boundary and it can cause a page fault or kernel panic on architectures
that enforce strict MMIO boundaries.
Fix this by increasing the mapping size to include NVME_REG_CSTS.
Fixes: ffb0863426eb9 ("PCI: Disable Samsung SM961/PM961 NVMe before FLR")
Signed-off-by: Mohamad Raizudeen <[email protected]>
---
drivers/pci/quirks.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index b09f27f7846f..ed03892cc960 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -4090,7 +4090,7 @@ static int nvme_disable_and_flr(struct pci_dev *dev, bool probe)
if (probe)
return 0;
- bar = pci_iomap(dev, 0, NVME_REG_CC + sizeof(cfg));
+ bar = pci_iomap(dev, 0, NVME_REG_CSTS + sizeof(cfg));
if (!bar)
return -ENOTTY;
--
2.53.0