Re: [PATCH v2] PCI: quirks: Fix out-of-bounds MMIO read in nvme_disable_and_flr()

[Mohamad Raizudeen]

On Thu, Sep 03, 2026 at 08:34:43AM -0600, Alex Williamson wrote:
> On Thu,  3 Sep 2026 09:30:49 +0530
> Mohamad Raizudeen <raizudeen.kerneldev@xxxxxxxxx> wrote:
> 
> > In nvme_disable_and_flr(), the PCI bar is mapped using
> > NVME_REG_CC + sizeof(cfg) which is (0x14 + 4 = 0x18 bytes)
> > 
> > However, the function later reads the controller status from
> > NVME_REG_CSTS - offset 0x1C, which is outside the mapped 0x18 byte
> > boundary. Reading past the mapped MMIO region is undefined behavior and
> > can return invalid data.
> 
> "Undefined behavior" still seems an overstatement.  The code violates
> the API contract, it should be fixed, but it's effectively harmless
> afaict.
>  
> > Fix this by increasing the mapping size to include NVME_REG_CSTS.
> > 
> > Fixes: ffb0863426eb9 ("PCI: Disable Samsung SM961/PM961 NVMe before
> > FLR") Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@xxxxxxxxx>
> > ---
> > Changes in v2:
> > - Changed the commit message to avoid overstating the risk as pointed
> >   out by Alex Williamson, to be more accurate about the actual
> > behavior.
> > 
> >  drivers/pci/quirks.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
> > index b09f27f7846f..ed03892cc960 100644
> > --- a/drivers/pci/quirks.c
> > +++ b/drivers/pci/quirks.c
> > @@ -4090,7 +4090,7 @@ static int nvme_disable_and_flr(struct pci_dev
> > *dev, bool probe) if (probe)
> >  		return 0;
> >  
> > -	bar = pci_iomap(dev, 0, NVME_REG_CC + sizeof(cfg));
> > +	bar = pci_iomap(dev, 0, NVME_REG_CSTS + sizeof(cfg));
> >  	if (!bar)
> >  		return -ENOTTY;
> >  
> 
> The cfg variable is no longer related to the mapping size now, it
> happens to be the same size, but this should be sizeof(u32) to avoid
> confusion.  Thanks,
> 
> Alex

Hi Alex,

I will make that change and update the commit message for v3.

Thanks,
Mohamad Raizudeen