Re: [PATCH] PCI: sysfs: Reject unaligned resource I/O port accesses

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The `IS_ALIGNED()` macro is invoked with a user-controlled argument (`count`) that is not guaranteed to be a power of two.
--

--- Patch [1]: [PATCH] PCI: sysfs: Reject unaligned resource I/O port accesses ---
commit 5ca53d551b5755e8c03169b8a70d53f035905df7
Author: Deepanshu Kartikey <[email protected]>

PCI: sysfs: Reject unaligned resource I/O port accesses

This commit adds a check in pci_resource_io() to validate that the requested
port is aligned to the access size. This prevents alignment faults and kernel
oopses on architectures like arm64 when accessing Device-memory mappings.

Closes: https://syzkaller.appspot.com/bug?extid=7134530b25073b4ef373

> diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
> index 5ec0b245a69bd..72f0404a34e99 100644
> --- a/drivers/pci/pci-sysfs.c
> +++ b/drivers/pci/pci-sysfs.c
> @@ -1175,6 +1175,9 @@ static ssize_t pci_resource_io(struct file *filp, struct kobject *kobj,
>  	if (port + count - 1 > pci_resource_end(pdev, bar))
>  		return -EINVAL;
>  
> +	if (!IS_ALIGNED(port, count))
> +		return -EINVAL;
> +

[Severity: Low]
Does this code call IS_ALIGNED() with an unvalidated user input for the
alignment argument?

The IS_ALIGNED() macro strictly requires its alignment argument to be a power
of two, but count comes from user space (via pread or pwrite) and could be a
non-power-of-two value like 3. Passing a non-power-of-two value results in
meaningless bitwise operations.

While the subsequent switch (count) statement catches and rejects invalid
sizes by returning -EINVAL, would it be more appropriate to perform this
alignment check after validating that count is actually 1, 2, or 4?

>  	switch (count) {
>  	case 1:
>  		if (write)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1