linux-stable.git/drivers/pci/rom.c, branch linux-rolling-stable

PCI: Check ROM header and data structure addr before accessing

2026-07-24T14:19:59+00:00

[ Upstream commit 538796b807fcfb81b2ce40cc97a614fd8588feb5 ]

We meet a crash when running stress-ng on x86_64 machine:

  BUG: unable to handle page fault for address: ffa0000007f40000
  RIP: 0010:pci_get_rom_size+0x52/0x220
  Call Trace:
  
    pci_map_rom+0x80/0x130
    pci_read_rom+0x4b/0xe0
    kernfs_file_read_iter+0x96/0x180
    vfs_read+0x1b1/0x300

Our analysis reveals that the ROM space's start address is
0xffa0000007f30000, and size is 0x10000. Because of broken ROM space,
before calling readl(pds), the pds's value is 0xffa0000007f3ffff, which is
already pointed to the ROM space end, invoking readl() would read 4 bytes
therefore cause an out-of-bounds access and trigger a crash.  Fix this by
adding image header and data structure checking.

We also found another crash on arm64 machine:

  Unable to handle kernel paging request at virtual address ffff8000dd1393ff
  Mem abort info:
  ESR = 0x0000000096000021
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x21: alignment fault

The call trace is the same with x86_64, but the crash reason is that the
data structure addr is not aligned with 4, and arm64 machine report
"alignment fault". Fix this by adding alignment checking.

Fixes: 47b975d234ea ("PCI: Avoid iterating through memory outside the resource window")
Suggested-by: Guanghui Feng 
Signed-off-by: Guixin Liu 
[bhelgaas: shorten function names, wrap comments]
Signed-off-by: Bjorn Helgaas 
Reviewed-by: Andy Shevchenko 
Link: https://patch.msgid.link/20260508082128.3344255-3-kanie@linux.alibaba.com
Signed-off-by: Sasha Levin

PCI: Introduce named defines for PCI ROM

2026-07-24T14:19:59+00:00

[ Upstream commit 113e86bc58a918f85d250723436a4d541a873358 ]

Convert the magic numbers associated with PCI ROM into named
definitions. Some of these definitions will be used in the second
fix patch.

Signed-off-by: Guixin Liu 
Signed-off-by: Bjorn Helgaas 
Reviewed-by: Andy Shevchenko 
Reviewed-by: Krzysztof Wilczyński 
Link: https://patch.msgid.link/20260508082128.3344255-2-kanie@linux.alibaba.com
Stable-dep-of: 538796b807fc ("PCI: Check ROM header and data structure addr before accessing")
Signed-off-by: Sasha Levin

PCI: Prefer 'unsigned int' over bare 'unsigned'

2021-10-27T18:41:22+00:00

The bare "unsigned" type implicitly means "unsigned int", but the preferred
coding style is to use the complete type name.

Update the bare use of "unsigned" to the preferred "unsigned int".

No change to functionality intended.

See a1ce18e4f941 ("checkpatch: warn on bare unsigned or signed declarations
without int").

Link: https://lore.kernel.org/r/20211013014136.1117543-1-kw@linux.com
Signed-off-by: Krzysztof Wilczyński 
Signed-off-by: Bjorn Helgaas

PCI: Use ioremap(), not phys_to_virt() for platform ROM

2020-03-30T14:52:23+00:00

On some EFI systems, the video BIOS is provided by the EFI firmware.  The
boot stub code stores the physical address of the ROM image in pdev->rom.
Currently we attempt to access this pointer using phys_to_virt(), which
doesn't work with CONFIG_HIGHMEM.

On these systems, attempting to load the radeon module on a x86_32 kernel
can result in the following:

  BUG: unable to handle page fault for address: 3e8ed03c
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  *pde = 00000000
  Oops: 0000 [#1] PREEMPT SMP
  CPU: 0 PID: 317 Comm: systemd-udevd Not tainted 5.6.0-rc3-next-20200228 #2
  Hardware name: Apple Computer, Inc. MacPro1,1/Mac-F4208DC8, BIOS     MP11.88Z.005C.B08.0707021221 07/02/07
  EIP: radeon_get_bios+0x5ed/0xe50 [radeon]
  Code: 00 00 84 c0 0f 85 12 fd ff ff c7 87 64 01 00 00 00 00 00 00 8b 47 08 8b 55 b0 e8 1e 83 e1 d6 85 c0 74 1a 8b 55 c0 85 d2 74 13 <80> 38 55 75 0e 80 78 01 aa 0f 84 a4 03 00 00 8d 74 26 00 68 dc 06
  EAX: 3e8ed03c EBX: 00000000 ECX: 3e8ed03c EDX: 00010000
  ESI: 00040000 EDI: eec04000 EBP: eef3fc60 ESP: eef3fbe0
  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 EFLAGS: 00010206
  CR0: 80050033 CR2: 3e8ed03c CR3: 2ec77000 CR4: 000006d0
  Call Trace:
   r520_init+0x26/0x240 [radeon]
   radeon_device_init+0x533/0xa50 [radeon]
   radeon_driver_load_kms+0x80/0x220 [radeon]
   drm_dev_register+0xa7/0x180 [drm]
   radeon_pci_probe+0x10f/0x1a0 [radeon]
   pci_device_probe+0xd4/0x140

Fix the issue by updating all drivers which can access a platform provided
ROM. Instead of calling the helper function pci_platform_rom() which uses
phys_to_virt(), call ioremap() directly on the pdev->rom.

radeon_read_platform_bios() previously directly accessed an __iomem
pointer. Avoid this by calling memcpy_fromio() instead of kmemdup().

pci_platform_rom() now has no remaining callers, so remove it.

Link: https://lore.kernel.org/r/20200319021623.5426-1-mikel@mikelr.com
Signed-off-by: Mikel Rychliski 
Signed-off-by: Bjorn Helgaas 
Acked-by: Alex Deucher

PCI: Make pci_get_rom_size() static

2018-06-30T02:17:26+00:00

pci_get_rom_size() is called only from pci_map_rom(), so it can be static.
Make it static and remove the declaration from include/linux/pci.h.

Signed-off-by: Bjorn Helgaas

PCI: Add check code for last image indicator not set

2018-06-30T02:16:23+00:00

If the "last image" indicator was not set in the PCI data struct, print "No
more image in the PCI ROM" instead of looping back and printing "Invalid
PCI ROM header signature".

Signed-off-by: Rex Zhu 
Signed-off-by: Bjorn Helgaas 
Reviewed-by: Alex Deucher

PCI: Avoid accessing memory outside the ROM BAR

2018-06-30T02:07:17+00:00

pci_get_rom_size() accepts the base and size of the ROM BAR as arguments.
The byte at "rom + size" is the first byte *past* the ROM, so change ">" to
">=" to avoid accessing beyond the actual length of the ROM BAR.

Signed-off-by: Rex Zhu 
[bhelgaas: changelog]
Signed-off-by: Bjorn Helgaas 
Reviewed-by: Alex Deucher

PCI: Tidy comments

2018-03-19T19:20:43+00:00

Remove pointless comments that tell us the file name, remove blank line
comments, follow multi-line comment conventions.  No functional change
intended.

Signed-off-by: Bjorn Helgaas

Merge branch 'pci/spdx' into next

2018-02-01T17:40:07+00:00

* pci/spdx:
  PCI: Add SPDX GPL-2.0+ to replace implicit GPL v2 or later statement
  PCI: Add SPDX GPL-2.0+ to replace GPL v2 or later boilerplate
  PCI: Add SPDX GPL-2.0 to replace COPYING boilerplate
  PCI: Add SPDX GPL-2.0 to replace GPL v2 boilerplate
  PCI: Add SPDX GPL-2.0 when no license was specified

Merge branch 'pci/resource' into next

2018-01-31T16:12:56+00:00

* pci/resource:
  PCI: tegra: Remove PCI_REASSIGN_ALL_BUS use on Tegra
  resource: Set type when reserving new regions
  resource: Set type of "reserve=" user-specified resources
  irqchip/i8259: Set I/O port resource types correctly
  powerpc: Set I/O port resource types correctly
  MIPS: Set I/O port resource types correctly
  vgacon: Set VGA struct resource types
  PCI: Use dev_info() rather than dev_err() for ROM validation
  PCI: Remove PCI_REASSIGN_ALL_RSRC use on arm and arm64
  PCI: Remove sysfs resource mmap warning

Conflicts:
	drivers/pci/rom.c