mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-01-12 01:20:14 +00:00
48f0143566
According to Dan Carpenter, smatch detects issue with size parameter given
to pci_rebar_size_supported():
drivers/pci/rebar.c:142 pci_rebar_size_supported()
error: undefined (user controlled) shift '(((1))) << size'
The problem is this call tree, which uses the 'size' from the user to shift
in BIT() without validating it:
__resource_resize_store # takes 'buf' from user sysfs write
kstrtoul(buf, 0, &size) # converts to unsigned long
pci_resize_resource # truncates to int
pci_rebar_size_supported # BIT(size) without validation
There could be similar problems also with pci_resize_resource() parameter
values coming from drivers.
Add 'size' validation to pci_rebar_size_supported().
There seems to be no SZ_128T prior to this so add one to be able to specify
the largest size supported by the kernel (PCIe r7.0 spec already defines
sizes even beyond 128TB but kernel does not yet support them).
The issue looks older than the introduction of pci_rebar_size_supported()
by bb1fabd0d94e ("PCI: Add pci_rebar_size_supported() helper").
It would be also nice to convert 'size' unsigned too everywhere, maybe even
u8 but that is left as further work.
Fixes: 8bb705e3e79d ("PCI: Add pci_resize_resource() for resizing BARs")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/aSA1WiRG3RuhqZMY@stanley.mountain/
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[bhelgaas: commit log, add report URL]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20251124153740.2995-1-ilpo.jarvinen@linux.intel.com
73 lines
2.0 KiB
C
73 lines
2.0 KiB
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
/*
|
|
* include/linux/sizes.h
|
|
*/
|
|
#ifndef __LINUX_SIZES_H__
|
|
#define __LINUX_SIZES_H__
|
|
|
|
#include <linux/const.h>
|
|
|
|
#define SZ_1 0x00000001
|
|
#define SZ_2 0x00000002
|
|
#define SZ_4 0x00000004
|
|
#define SZ_8 0x00000008
|
|
#define SZ_16 0x00000010
|
|
#define SZ_32 0x00000020
|
|
#define SZ_64 0x00000040
|
|
#define SZ_128 0x00000080
|
|
#define SZ_256 0x00000100
|
|
#define SZ_512 0x00000200
|
|
|
|
#define SZ_1K 0x00000400
|
|
#define SZ_2K 0x00000800
|
|
#define SZ_4K 0x00001000
|
|
#define SZ_8K 0x00002000
|
|
#define SZ_16K 0x00004000
|
|
#define SZ_24K 0x00006000
|
|
#define SZ_32K 0x00008000
|
|
#define SZ_64K 0x00010000
|
|
#define SZ_128K 0x00020000
|
|
#define SZ_192K 0x00030000
|
|
#define SZ_256K 0x00040000
|
|
#define SZ_384K 0x00060000
|
|
#define SZ_512K 0x00080000
|
|
|
|
#define SZ_1M 0x00100000
|
|
#define SZ_2M 0x00200000
|
|
#define SZ_3M 0x00300000
|
|
#define SZ_4M 0x00400000
|
|
#define SZ_6M 0x00600000
|
|
#define SZ_8M 0x00800000
|
|
#define SZ_12M 0x00c00000
|
|
#define SZ_16M 0x01000000
|
|
#define SZ_18M 0x01200000
|
|
#define SZ_24M 0x01800000
|
|
#define SZ_32M 0x02000000
|
|
#define SZ_64M 0x04000000
|
|
#define SZ_128M 0x08000000
|
|
#define SZ_256M 0x10000000
|
|
#define SZ_512M 0x20000000
|
|
|
|
#define SZ_1G 0x40000000
|
|
#define SZ_2G 0x80000000
|
|
|
|
#define SZ_4G _AC(0x100000000, ULL)
|
|
#define SZ_8G _AC(0x200000000, ULL)
|
|
#define SZ_16G _AC(0x400000000, ULL)
|
|
#define SZ_32G _AC(0x800000000, ULL)
|
|
#define SZ_64G _AC(0x1000000000, ULL)
|
|
#define SZ_128G _AC(0x2000000000, ULL)
|
|
#define SZ_256G _AC(0x4000000000, ULL)
|
|
#define SZ_512G _AC(0x8000000000, ULL)
|
|
|
|
#define SZ_1T _AC(0x10000000000, ULL)
|
|
#define SZ_2T _AC(0x20000000000, ULL)
|
|
#define SZ_4T _AC(0x40000000000, ULL)
|
|
#define SZ_8T _AC(0x80000000000, ULL)
|
|
#define SZ_16T _AC(0x100000000000, ULL)
|
|
#define SZ_32T _AC(0x200000000000, ULL)
|
|
#define SZ_64T _AC(0x400000000000, ULL)
|
|
#define SZ_128T _AC(0x800000000000, ULL)
|
|
|
|
#endif /* __LINUX_SIZES_H__ */
|