[PATCH 0/5] PCI: Fix invalid input handling and a NULL dereference

From: shao.mingyin

Date: Fri Nov 06 2026 - 11:27:36 EST


Several PCI paths consume values from the command line, a device tree,
config space or an endpoint driver without validating them, and the
ASPM link setup does not handle a downstream bus without function 0.
The five fixes reject the bad values, or skip the unsafe state, before
they reach a shift, an array index or a pointer dereference.

The series is ordered by severity and is independent patch-by-patch;
each patch can be applied and reviewed on its own, and taking a subset
is fine:

1/5 PCI: Reject negative resource alignment order
2/5 PCI: of: Bound num_lanes in of_pci_get_equalization_presets()
3/5 PCI/ASPM: Skip link-state setup without downstream function 0
4/5 PCI: rebar: Guard pci_rebar_bytes_to_size() against overflow
5/5 PCI: endpoint: Reject a zero interrupt number in raise_irq

1/5 rejects a negative pci=resource_alignment= order, 2/5 rejects a
num_lanes value larger than the 16-entry preset arrays, 3/5 skips ASPM
link-state setup when the downstream bus has no function 0, 4/5 rejects
resizable BAR sizes that cannot be encoded, and 5/5 rejects a zero
MSI/MSI-X interrupt number before it underflows in the controller.

All five are single-file changes under drivers/pci/ and pass git apply
and checkpatch. Each patch was tested on 7.3.0-next-20261030 in a
QEMU/TCG guest with an unpatched/patched A/B comparison; the test
section in each patch describes the setup and the observed results.

Shao Mingyin (5):
PCI: Reject negative resource alignment order
PCI: of: Bound num_lanes in of_pci_get_equalization_presets()
PCI/ASPM: Skip link-state setup without downstream function 0
PCI: rebar: Guard pci_rebar_bytes_to_size() against overflow
PCI: endpoint: Reject a zero interrupt number in raise_irq

drivers/pci/endpoint/pci-epc-core.c | 4 ++++
drivers/pci/of.c | 3 +++
drivers/pci/pci.c | 2 +-
drivers/pci/pcie/aspm.c | 3 +++
drivers/pci/rebar.c | 7 +++++++
5 files changed, 18 insertions(+), 1 deletion(-)

---
base-commit: 7649ba73f9e7e1e04d0b46213e39c79ae09dd55c