[PATCH v2] PCI: quirks: Fix out-of-bounds MMIO read in mellanox_check_broken_intx_masking()

[Mohamad Raizudeen]

The mellanox_check_broken_intx_masking() function maps 4 bytes of MMIO
memory using ioremap() with a size of 4 bytes, but then reads two 32 bit
values using ioread32be(fw_ver) and ioread32be(fw_ver + 1).

Because fw_ver is a pointer to a 32 bit type, fw_ver + 1 advances the
address by 4 bytes. Reading 4 bytes at offset 4 goes past the mapped 4
byte boundary. This violates the API contract.

Fix this by increasing the mapping size to 8 bytes to safely cover both
32 bits.

Fixes: 1600f62534b7b ("PCI: support INTx masking on ConnectX-4 with firmware x.14.1100+")
Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@xxxxxxxxx>
---
Changes in v2:
- Fixed a typo in the commit message("ad" -> "and").
- Updated commit message to use "violates the API contract" instead of
  "page fault or kernel panic" to avoid overstating the risk, matching
  the feedback from Alex Williamson on a similar patch.

Link for v1: https://lore.kernel.org/linux-pci/20260827071940.B7CC01F000E9@xxxxxxxxxxxxxxx/T/

 drivers/pci/quirks.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index de9bbccda21f..b30ca4244f14 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3714,7 +3714,7 @@ static void mellanox_check_broken_intx_masking(struct pci_dev *pdev)
 		return;
 	}
 
-	fw_ver = ioremap(pci_resource_start(pdev, 0), 4);
+	fw_ver = ioremap(pci_resource_start(pdev, 0), 8);
 	if (!fw_ver) {
 		pci_warn(pdev, "Can't map ConnectX-4 initialization segment\n");
 		goto out;
-- 
2.53.0