[PATCH] thunderbolt: Validate BAR 0 resource type and size

[syzbot]

From: Marco Elver <elver@xxxxxxxxxx>

The thunderbolt driver can crash with a page fault if it binds to an
arbitrary PCI device (e.g., via sysfs driver_override) that has an I/O port
BAR at index 0 instead of an MMIO BAR.

The driver maps this BAR without validating its type or size. When it
attempts to read a Thunderbolt register at a large offset, the resulting
I/O port cookie overflows the reserved PIO space on x86. This causes the
generic ioread32() function to misinterpret the out-of-bounds I/O port
cookie as a valid MMIO virtual address, leading to a direct dereference of
an unmapped physical-like address and a page fault:

  BUG: unable to handle page fault for address: 00000000000556c0
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  ...
  Call Trace:
   <TASK>
   nhi_probe+0xcc/0x870 drivers/thunderbolt/nhi.c:1198
   nhi_pci_probe+0x46b/0x580 drivers/thunderbolt/pci.c:479
   local_pci_probe drivers/pci/pci-driver.c:332 [inline]
   pci_call_probe drivers/pci/pci-driver.c:394 [inline]
   __pci_device_probe drivers/pci/pci-driver.c:455 [inline]
   pci_device_probe+0x431/0xc90 drivers/pci/pci-driver.c:489

To fix this, add explicit validation in nhi_pci_probe() to ensure that BAR
0 is an MMIO resource and is large enough to contain all the NHI registers
before attempting to map it. The NHI register space extends up to offset
0x39944 (REG_FW_STS), so checking for a minimum size of 0x40000 (256 KB) is
appropriate.

Fixes: 16603153666d ("thunderbolt: Add initial cactus ridge NHI support")
Assisted-by: Gemini:gemini-3.7-flash Gemini:gemini-3.1-pro-preview syzbot
Reported-by: syzbot+97999b836ee62ddb0181@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=97999b836ee62ddb0181
Link: https://syzkaller.appspot.com/ai_job?id=2570f821-2184-40c8-8bd7-344a30c18a13
Signed-off-by: Marco Elver <elver@xxxxxxxxxx>

---
diff --git a/drivers/thunderbolt/nhi_regs.h b/drivers/thunderbolt/nhi_regs.h
index d6a197fab..1feb0bfb0 100644
--- a/drivers/thunderbolt/nhi_regs.h
+++ b/drivers/thunderbolt/nhi_regs.h
@@ -140,6 +140,9 @@ struct ring_desc {
 #define REG_FW_STS_ICM_EN_INVERT	BIT(1)
 #define REG_FW_STS_ICM_EN		BIT(0)
 
+/* Minimum BAR size to contain NHI registers */
+#define NHI_MIN_BAR_SIZE		0x40000
+
 /* ICL NHI VSEC registers */
 
 /* FW ready */
diff --git a/drivers/thunderbolt/pci.c b/drivers/thunderbolt/pci.c
index bbd186c29..fa69e4609 100644
--- a/drivers/thunderbolt/pci.c
+++ b/drivers/thunderbolt/pci.c
@@ -466,6 +466,14 @@ static int nhi_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	nhi->dev = dev;
 	nhi->ops = (const struct tb_nhi_ops *)id->driver_data ?: &pci_nhi_default_ops;
 
+	/* Ensure BAR 0 is an MMIO resource */
+	if (!(pci_resource_flags(pdev, 0) & IORESOURCE_MEM))
+		return dev_err_probe(dev, -EINVAL, "BAR 0 is not an MMIO resource\n");
+
+	/* Ensure BAR 0 is large enough to contain the NHI registers */
+	if (pci_resource_len(pdev, 0) < NHI_MIN_BAR_SIZE)
+		return dev_err_probe(dev, -EINVAL, "BAR 0 is too small\n");
+
 	nhi->iobase = pcim_iomap_region(pdev, 0, "thunderbolt");
 	res = PTR_ERR_OR_ZERO(nhi->iobase);
 	if (res)


base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
-- 
See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
The person who has signed off on the patch is responsible for
addressing comments.
syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxx.