diff options
| author | Mohamad Raizudeen <raizudeen.kerneldev@gmail.com> | 2026-09-03 22:16:15 +0530 |
|---|---|---|
| committer | Bjorn Helgaas <bhelgaas@google.com> | 2026-10-14 12:02:44 -0500 |
| commit | 6aaa3f42e3410ea8e26c857477260159f724cb1d (patch) | |
| tree | 35fb2ebcbe0bf673a2598166b0fd9edf2c855e84 /scripts/basic | |
| parent | 5f30217ec296fb5742f6fd306586dbca5b81b4eb (diff) | |
| download | lwn-6aaa3f42e3410ea8e26c857477260159f724cb1d.tar.gz lwn-6aaa3f42e3410ea8e26c857477260159f724cb1d.zip | |
PCI: Fix out-of-bounds MMIO read in nvme_disable_and_flr()
In nvme_disable_and_flr(), the PCI bar is mapped using
NVME_REG_CC + sizeof(cfg) which is (0x14 + 4 = 0x18 bytes)
However, the function later reads the controller status from
NVME_REG_CSTS - offset 0x1C, which is outside the mapped 0x18 byte
boundary. This violates the API contract.
Fix this by increasing the mapping size to include NVME_REG_CSTS. Also
change sizeof(cfg) to sizeof(u32) to make the intent clearer.
Fixes: ffb0863426eb9 ("PCI: Disable Samsung SM961/PM961 NVMe before FLR")
Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Alex Williamson <alex@shazbot.org>
Link: https://patch.msgid.link/20260903164615.5744-1-raizudeen.kerneldev@gmail.com
Diffstat (limited to 'scripts/basic')
0 files changed, 0 insertions, 0 deletions