Re: [BUG] thunderbolt: page fault on ioread32 in nhi_probe

[Mika Westerberg]

Hi,

On Mon, Sep 14, 2026 at 05:02:42PM +0800, CJ wrote:
> 
> Hi,
> 
> 
> I am reporting a page fault in the Thunderbolt NHI probe path, triggered by a
> syzkaller reproducer.  The issue is reproducible with HEAD commit
> cee9395acd8043be0644b25c34bfa86623f2b935 (v7.3-rc1, Linux 7.3.0-rc1).
> 
> 
> The reproducer mounts sysfs, unbinds PCI device 0000:00:03.0, writes
> "thunderbolt" to its driver_override attribute, and then writes the device name
> to the thunderbolt driver's bind attribute, forcing the driver onto a device
> that is not a Thunderbolt controller.
> 
> 
> The console shows "BUG: unable to handle page fault for address:
> 00000000000556c0" with a supervisor read access, RIP in ioread32 (readl
> inlined), reached from nhi_probe and nhi_pci_probe through local_pci_probe.  The
> faulting address is a low MMIO-style address, which indicates a register access
> at an offset from a base that was never mapped for this device.

Yes if you bind it to a random device you get what you asked for. Don't do
that. I think syzkaller recently got fixed not to do that.