Re: [PATCH] misc: ibmasm: Fix out-of-bounds MMIO access during module load

[Greg KH]

On Tue, Jun 23, 2026 at 03:09:09PM +0800, w15303746062@xxxxxxx wrote:
> From: Mingyu Wang <25181214217@xxxxxxxxxxxxxxxxx>
> 
> The ibmasm driver maps PCI BAR 0 without verifying if the hardware-provided
> resource length is sufficient. The driver statically accesses the
> INTR_CONTROL_REGISTER at offset 0x13A4.

The kernel trusts the hardware to not do foolish things like this :)

> When evaluating the driver against emulated hardware or during virtual
> device fuzzing, a malformed device may expose a significantly undersized
> BAR 0 (e.g., 4KB). In this scenario, the readl() in enable_sp_interrupts()
> crosses the mapped page boundary into unmapped memory, causing a page fault
> during probe.

Are you sure this is the only code path for this type of issue for this
device/driver?  Why just worry about this one?


thanks,

greg k-h