[PATCH 1/3] PCI: Fix NULL dereference when shrinking window without optional size

[Ilpo Järvinen]

adjust_bridge_window() assumes a bridge window it needs to shrink is on
add_list. A window is only added to add_list when it has optional size
or alignment. When resource distribution gives a window that is not on
add_list less space than its required size, res_to_dev_res() returns NULL
that is unconditionally dereferenced.

Consider a hotplug Root Port with no spare pref space and a switch below
it with two non-hotplug Downstream Ports. 02:00.0 has a 2M pref BAR below
it and 02:01.0 a 1M one. Alignment leaves only 1M of pref space for
02:00.0, and hot-add (emulated using a remove+rescan cycle) crashes in
the inlined adjust_bridge_window():

  BUG: kernel NULL pointer dereference, address: 0000000000000030
  RIP: 0010:pci_bus_distribute_available_resources+0x19b/0x4b0
  Call Trace:
   <TASK>
   pci_bus_distribute_available_resources+0x468/0x4b0
   pci_bus_distribute_available_resources+0x468/0x4b0
   pci_bridge_distribute_available_resources+0x7a/0x90
   pci_assign_unassigned_bridge_resources+0x43/0xe0
   pci_rescan_bus_bridge_resize+0x23/0x40
   bus_rescan_store+0x63/0x80

The required size must not be shrunk, so return early when the window
has no optional size.

Fixes: dc4b4d04e1ca ("PCI: Prevent shrinking bridge window from its required size")
Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@xxxxxxxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
---

As it was a non-public run of sashiko, no link is available to sashiko's
report.

 drivers/pci/setup-bus.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index ed16ef7c26fa..bd0974def921 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -1896,7 +1896,11 @@ static void adjust_bridge_window(struct pci_dev *bridge, struct resource *res,
 				break;
 		}
 
+		/* Without optional size, there is nothing to shrink. */
 		dev_res = res_to_dev_res(add_list, res);
+		if (!dev_res)
+			return;
+
 		add_size = size - new_size;
 		if (add_size < dev_res->add_size) {
 			dev_res->add_size -= add_size;
-- 
2.47.3