[BUG] nozomi: missing BAR-TYPE check -- writew() on an IOPORT cookie
From: Farhad Alemi
Date: Fri Aug 28 2026 - 01:34:37 EST
Hello,
As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:
https://github.com/farhad-alemi/public_bug_reports/tree/main/148-tty-nozomi-writew-on-ioport-cookie/
nozomi 0000:00:02.0: Card type is: 8192
BUG: unable to handle page fault for address: 000000000001d044
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
Oops: Oops: 0002 [#1] SMP KASAN NOPTI
RIP: 0010:nozomi_card_init+0x9fe/0x14c0
Call Trace:
nozomi_card_init+0x9fe/0x14c0
pci_device_probe+0x436/0xc90
really_probe+0x267/0xaf0
__driver_probe_device+0x1e2/0x350
driver_probe_device+0x4f/0x240
__device_attach_driver+0x270/0x410
bus_for_each_drv+0x258/0x2f0
__device_attach+0x2c5/0x450
drivers_probe_store+0x11c/0x220
kernfs_fop_write_iter+0x3af/0x540
ksys_write+0x150/0x270
Our reproducer.c is available upon request.
Happy to test a patch if that would help.
Regards,