From nobody Sat Jul 25 04:56:46 2026 Received: from zg8tmtyylji0my4xnjqumte4.icoremail.net (zg8tmtyylji0my4xnjqumte4.icoremail.net [162.243.164.118]) by smtp.subspace.kernel.org (Postfix) with ESMTP id E5EFE3911D3; Fri, 17 Jul 2026 15:10:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.243.164.118 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784301011; cv=none; b=rAHwfb8+B0fS14GXbq9HEh39lAa4VDltQQpDIyc3EKEKMC0bIUaXS4jKfcs61CWCN9E9GiVOigTJK3U2swpaQi9RHEk0Bxqkw3ubxpOBozXyicbw+lgh0iwU2bE1JxpFcq9DjH3/ysXsrVEsXrSNhvwWwbjpzsQ7urJVHw5d6s8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784301011; c=relaxed/simple; bh=T48itO9BTAprMr+guQs8A9h6LUkElMQGpmoF+Dltuoo=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=rm2IilTKJGukmH033t3PBYzf9zC5fpVeHKny6E2c16x4JwifGkHi3jMrOd12a/ctHj1M4WdHOIXMNWiquoqKABFT5C6BBs3/lPbluh8R6IaoHqUd+8P1OHcQ6aBhaAPAtkqZrhtkwomjLDHhG9QgJpHGeJx5h5E7S6Bybm2YNgg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=stu.xidian.edu.cn; spf=pass smtp.mailfrom=stu.xidian.edu.cn; dkim=fail (0-bit key) header.d=stu.xidian.edu.cn header.i=@stu.xidian.edu.cn header.b=2ucPyR9/ reason="key not found in DNS"; arc=none smtp.client-ip=162.243.164.118 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=stu.xidian.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=stu.xidian.edu.cn Authentication-Results: smtp.subspace.kernel.org; dkim=fail reason="key not found in DNS" (0-bit key) header.d=stu.xidian.edu.cn header.i=@stu.xidian.edu.cn header.b="2ucPyR9/" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=stu.xidian.edu.cn; s=dkim; h=Received:From:To:Cc:Subject:Date: Message-Id:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding; bh=+i0pzYp5ov+CVjL5Zd1h9BUIvraHx8sSVD W7eroboWs=; b=2ucPyR9/wRyFlC8KpbUTUop9gyXLibGskwgfyc3igpr7QYtZpj O3of6b85q0ES5J3eX+QaWKhTeD608rjGtgQjY9bi3qImr58u8gYIxeFr7SMfT1ax CrN2q8teKSGQpfCKC1ZiFCjehfn808b880Ig6r7WcVLoPG7TrG5aTOP2o= Received: from wmy.localdomain (unknown [115.53.182.236]) by hzbj-edu-front-3.icoremail.net (Coremail) with SMTP id BbQMCkCG7NXBRVpqIGESAQ--.57240S3; Fri, 17 Jul 2026 23:10:00 +0800 (CST) From: Mingyu Wang <25181214217@stu.xidian.edu.cn> To: gregkh@linuxfoundation.org, arnd@arndb.de Cc: kees@kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Mingyu Wang <25181214217@stu.xidian.edu.cn> Subject: [PATCH v5 1/2] misc: ibmasm: Fix static out-of-bounds MMIO access during probe Date: Fri, 17 Jul 2026 23:09:50 +0800 Message-Id: <20260717150951.85927-2-25181214217@stu.xidian.edu.cn> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260717150951.85927-1-25181214217@stu.xidian.edu.cn> References: <20260717150951.85927-1-25181214217@stu.xidian.edu.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: BbQMCkCG7NXBRVpqIGESAQ--.57240S3 X-Coremail-Antispam: 1UD129KBjvJXoWxAFyfXw13Kry8XrWfJF1DWrg_yoW5ZryUpF Z7W3yYkrWUXF4vgw47J3yDuFyrGas7KFWj93y3Aa4fZFyYyFy3ZF1jka47WryxJ3WkKa10 yrWUJry5Wa1DJaUanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUmj14x267AKxVW8JVW5JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2048vs2IY020E87I2jVAFwI0_Jr4l82xGYIkIc2 x26xkF7I0E14v26r1I6r4UM28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4kI8wA2z4x0 Y4vE2Ix0cI8IcVAFwI0_Jr0_JF4l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr0_Cr1l84 ACjcxK6I8E87Iv67AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVCY1x0267AKxVW8Jr0_Cr1U M2vYz4IE04k24VAvwVAKI4IrM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64 kE6c02F40Ex7xfMcIj6xIIjxv20xvE14v26r1j6r18McIj6I8E87Iv67AKxVWUJVW8JwAm 72CE4IkC6x0Yz7v_Jr0_Gr1lF7xvr2IYc2Ij64vIr41lF7I21c0EjII2zVCS5cI20VAGYx C7MxkF7I0En4kS14v26r126r1DMxAIw28IcxkI7VAKI48JMxC20s026xCaFVCjc4AY6r1j 6r4UMI8I3I0E5I8CrVAFwI0_Jr0_Jr4lx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17CEb7 AF67AKxVWUAVWUtwCIc40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v26r1j6r1xMIIF0xvE 2Ix0cI8IcVCY1x0267AKxVW8JVWxJwCI42IY6xAIw20EY4v20xvaj40_Jr0_JF4lIxAIcV C2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVW8JVW8JrUvcSsGvfC2Kfnx nUUI43ZEXa7VUjW8BUUUUUU== X-CM-SenderInfo: qsvrmiqsrujiux6v33wo0lvxldqovvfxof0/1tbiAgUREWpY9Xh9swAEsy Content-Type: text/plain; charset="utf-8" The ibmasm driver maps PCI BAR 0 without verifying if the hardware-provided resource length is sufficient to cover statically accessed registers. When evaluating the driver against emulated hardware or during virtual device fuzzing, a malformed device may expose a significantly undersized BAR 0. This leads to an out-of-bounds (OOB) access when reading or writing to registers such as INTR_CONTROL_REGISTER (offset 0x13A4) or mouse interrupt controls (offset 0xAC000) during probe. A page fault here while holding the idempotent_init_module() lock causes a cascading global soft lockup. Fix this by storing the mapped size in 'struct service_processor' and ensuring the BAR is at least large enough to cover the highest statically accessed hardware register before calling pci_ioremap_bar(). This highest static access (offset 0xAC1FC) occurs via the display_depth() macro during ibmasmfs filesystem initialization. Fixes: bdbeed75b288 ("pci: use pci_ioremap_bar() in drivers/misc") Cc: stable@vger.kernel.org Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn> --- drivers/misc/ibmasm/ibmasm.h | 1 + drivers/misc/ibmasm/lowlevel.h | 3 +++ drivers/misc/ibmasm/module.c | 13 +++++++++++++ 3 files changed, 17 insertions(+) diff --git a/drivers/misc/ibmasm/ibmasm.h b/drivers/misc/ibmasm/ibmasm.h index a5ced88ca923..8d69198bf10f 100644 --- a/drivers/misc/ibmasm/ibmasm.h +++ b/drivers/misc/ibmasm/ibmasm.h @@ -140,6 +140,7 @@ struct service_processor { struct list_head node; spinlock_t lock; void __iomem *base_address; + resource_size_t mapped_size; unsigned int irq; struct command *current_command; struct command *heartbeat; diff --git a/drivers/misc/ibmasm/lowlevel.h b/drivers/misc/ibmasm/lowlevel.h index 25f1ed07c3c5..970d30478c7b 100644 --- a/drivers/misc/ibmasm/lowlevel.h +++ b/drivers/misc/ibmasm/lowlevel.h @@ -33,6 +33,9 @@ #define INTR_STATUS_REGISTER 0x13A0 #define INTR_CONTROL_REGISTER 0x13A4 =20 +/* Highest static MMIO offset accessed during probe (display_depth during = fs init) */ +#define IBMASM_MAX_REG_OFFSET 0xAC1FC + #define SCOUT_COM_A_BASE 0x0000 #define SCOUT_COM_B_BASE 0x0100 #define SCOUT_COM_C_BASE 0x0200 diff --git a/drivers/misc/ibmasm/module.c b/drivers/misc/ibmasm/module.c index 4509c15a76a8..87d4d698a5ff 100644 --- a/drivers/misc/ibmasm/module.c +++ b/drivers/misc/ibmasm/module.c @@ -93,6 +93,19 @@ static int ibmasm_init_one(struct pci_dev *pdev, const s= truct pci_device_id *id) } =20 sp->irq =3D pdev->irq; + sp->mapped_size =3D pci_resource_len(pdev, 0); + + /* + * Ensure BAR 0 is large enough to cover the highest statically + * accessed hardware register (IBMASM_MAX_REG_OFFSET). + */ + if (sp->mapped_size < IBMASM_MAX_REG_OFFSET + 4) { + dev_err(sp->dev, "PCI BAR0 too small, need at least %zu bytes\n", + (size_t)(IBMASM_MAX_REG_OFFSET + 4)); + result =3D -ENODEV; + goto error_ioremap; + } + sp->base_address =3D pci_ioremap_bar(pdev, 0); if (!sp->base_address) { dev_err(sp->dev, "Failed to ioremap pci memory\n"); --=20 2.34.1 From nobody Sat Jul 25 04:56:47 2026 Received: from zg8tmtyylji0my4xnjqumte4.icoremail.net (zg8tmtyylji0my4xnjqumte4.icoremail.net [162.243.164.118]) by smtp.subspace.kernel.org (Postfix) with ESMTP id E5AE8383C87; Fri, 17 Jul 2026 15:10:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.243.164.118 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784301013; cv=none; b=lqPCGtDUn+qnx+lSZDSAf7isKsLfRdvsLZgONhGDQe5mCVhs7fH89YJjDmCoIIgLjk4mubUN4F7ZEMN6aDRnd9So8iY3OD4UtAYpUxFqZAYCG4wdWYp2WF2XbWH9EwGA4hC6OmkJOuEiTsX+N2kbCoXPTmypnxE6J6w8+iGWUoY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784301013; c=relaxed/simple; bh=ewx2bAFxgVu3pRmnHLBsRmI9l6DYvOiZkonyG8iGpu8=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=N0hhN3KLJAhDYfcLtevVx9Urh+Y1bkRQcyyfqfGUXUc7ywrlWrNBBWgs5i+22T0F1DQwZXMhaNF2IhPnFT/Y608hLN24QWvhEC3HjCV/+3Sei3ZIhEO8A5mYCJkzkMuraYj5ybM8gN8FtiFATkYPPFY55FLKpR0yDR3JPpf70RI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=stu.xidian.edu.cn; spf=pass smtp.mailfrom=stu.xidian.edu.cn; dkim=fail (0-bit key) header.d=stu.xidian.edu.cn header.i=@stu.xidian.edu.cn header.b=ytQ3TEDl reason="key not found in DNS"; arc=none smtp.client-ip=162.243.164.118 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=stu.xidian.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=stu.xidian.edu.cn Authentication-Results: smtp.subspace.kernel.org; dkim=fail reason="key not found in DNS" (0-bit key) header.d=stu.xidian.edu.cn header.i=@stu.xidian.edu.cn header.b="ytQ3TEDl" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=stu.xidian.edu.cn; s=dkim; h=Received:From:To:Cc:Subject:Date: Message-Id:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding; bh=7dHltZj7A+zDEAfCmivOE1Krlqe7eUJzob /kTJmg/Yw=; b=ytQ3TEDlmBISg+zloDcl3wJsfu/ON3twpAahIilY9wgj2LBZEw vqciZOBWGtayxsLYZowneBhZyk4uwEdbe0CHTjITsWIQ1Ykbd/WfM2yFbnK8Bb4u gc62+U1kiw8c1w6dq6gnqhU5abA4mzuuLwSe4stAXmTuoQ39dOX8mWLMk= Received: from wmy.localdomain (unknown [115.53.182.236]) by hzbj-edu-front-3.icoremail.net (Coremail) with SMTP id BbQMCkCG7NXBRVpqIGESAQ--.57240S4; Fri, 17 Jul 2026 23:10:04 +0800 (CST) From: Mingyu Wang <25181214217@stu.xidian.edu.cn> To: gregkh@linuxfoundation.org, arnd@arndb.de Cc: kees@kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Mingyu Wang <25181214217@stu.xidian.edu.cn> Subject: [PATCH v5 2/2] misc: ibmasm: Fix dynamic out-of-bounds MMIO access via malicious MFA Date: Fri, 17 Jul 2026 23:09:51 +0800 Message-Id: <20260717150951.85927-3-25181214217@stu.xidian.edu.cn> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260717150951.85927-1-25181214217@stu.xidian.edu.cn> References: <20260717150951.85927-1-25181214217@stu.xidian.edu.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: BbQMCkCG7NXBRVpqIGESAQ--.57240S4 X-Coremail-Antispam: 1UD129KBjvJXoWxCrykury7ZF43tF1fZF18Zrb_yoW7Jw4xpF n0vayrAr98ArW2qrZFkr4j9Fy5u3Z7Ga1UGry3AasavF15tF1UZa4UAay7WFW8X3Wvg3yY gryDJF4rC3WjqrJanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUmj14x267AKxVW5JVWrJwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2048vs2IY020E87I2jVAFwI0_Jryl82xGYIkIc2 x26xkF7I0E14v26r4j6ryUM28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4kI8wA2z4x0 Y4vE2Ix0cI8IcVAFwI0_Jr0_JF4l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr0_Cr1l84 ACjcxK6I8E87Iv67AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVCY1x0267AKxVW8Jr0_Cr1U M2vYz4IE04k24VAvwVAKI4IrM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64 kE6c02F40Ex7xfMcIj6xIIjxv20xvE14v26r1j6r18McIj6I8E87Iv67AKxVWUJVW8JwAm 72CE4IkC6x0Yz7v_Jr0_Gr1lF7xvr2IYc2Ij64vIr41lF7I21c0EjII2zVCS5cI20VAGYx C7MxkF7I0En4kS14v26r126r1DMxAIw28IcxkI7VAKI48JMxC20s026xCaFVCjc4AY6r1j 6r4UMI8I3I0E5I8CrVAFwI0_Jr0_Jr4lx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17CEb7 AF67AKxVWUAVWUtwCIc40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v26r1j6r1xMIIF0xvE 2Ix0cI8IcVCY1x0267AKxVW8JVWxJwCI42IY6xAIw20EY4v20xvaj40_Jr0_JF4lIxAIcV C2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVW8JVW8JrUvcSsGvfC2Kfnx nUUI43ZEXa7VUUByIUUUUUU== X-CM-SenderInfo: qsvrmiqsrujiux6v33wo0lvxldqovvfxof0/1tbiAgUREWpY9Xh9swAGsw Content-Type: text/plain; charset="utf-8" The ibmasm driver reads dynamic Message Frame Addresses (MFA) from hardware queues and uses them directly as offsets to dereference I2O messages via get_i2o_message(). If a malformed or fuzzed device provides a malicious MFA, it can cause the driver to access memory far beyond the mapped BAR, leading to an out-of-bounds (OOB) access and potential kernel panic during runtime. Fix this by validating the target offset against the actual mapped size before dereferencing. This validation strictly accounts for both the i2o_header and the dynamic payload size using safe subtraction to prevent integer overflow bypasses. If the bounds check fails, the invalid MFA is released back to the inbound queue via set_mfa_inbound() to prevent a hardware mailbox deadlock. Fixes: bdbeed75b288 ("pci: use pci_ioremap_bar() in drivers/misc") Cc: stable@vger.kernel.org Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn> --- drivers/misc/ibmasm/lowlevel.c | 42 ++++++++++++++++++++++++++++++---- drivers/misc/ibmasm/lowlevel.h | 20 ++++++++++++---- 2 files changed, 54 insertions(+), 8 deletions(-) diff --git a/drivers/misc/ibmasm/lowlevel.c b/drivers/misc/ibmasm/lowlevel.c index 5313230f36ad..403fad3b1af0 100644 --- a/drivers/misc/ibmasm/lowlevel.c +++ b/drivers/misc/ibmasm/lowlevel.c @@ -9,12 +9,23 @@ =20 #include "ibmasm.h" #include "lowlevel.h" -#include "i2o.h" #include "dot_command.h" #include "remote.h" =20 static struct i2o_header header =3D I2O_HEADER_TEMPLATE; =20 +struct i2o_message *get_i2o_message(void __iomem *base_address, + resource_size_t mapped_size, + u32 mfa, size_t msg_size) +{ + u32 offset =3D GET_MFA_ADDR(mfa); + + /* Prevent read/write beyond the ioremap region and avoid integer underfl= ow/overflow */ + if (unlikely(offset > mapped_size || msg_size > mapped_size - offset)) + return NULL; + + return (struct i2o_message *)(offset + base_address); +} =20 int ibmasm_send_i2o_message(struct service_processor *sp) { @@ -34,7 +45,13 @@ int ibmasm_send_i2o_message(struct service_processor *sp) return 1; =20 header.message_size =3D outgoing_message_size((unsigned int)command_size); - message =3D get_i2o_message(sp->base_address, mfa); + message =3D get_i2o_message(sp->base_address, sp->mapped_size, mfa, + sizeof(struct i2o_header) + command_size); + if (!message) { + /* Release the allocated inbound MFA to prevent mailbox deadlock */ + set_mfa_inbound(sp->base_address, mfa); + return 1; + } =20 memcpy_toio(&message->header, &header, sizeof(struct i2o_header)); memcpy_toio(&message->data, command->buffer, command_size); @@ -63,8 +80,25 @@ irqreturn_t ibmasm_interrupt_handler(int irq, void * dev= _id) =20 mfa =3D get_mfa_outbound(base_address); if (valid_mfa(mfa)) { - struct i2o_message *msg =3D get_i2o_message(base_address, mfa); - ibmasm_receive_message(sp, &msg->data, incoming_data_size(msg)); + struct i2o_message *msg =3D get_i2o_message(base_address, + sp->mapped_size, mfa, + sizeof(struct i2o_header)); + if (msg) { + u32 data_size =3D incoming_data_size(msg); + u32 offset =3D GET_MFA_ADDR(mfa); + + /* + * Secondary check for dynamic payload size. + * Use subtraction to perfectly prevent integer overflow. + */ + if (unlikely(data_size > sp->mapped_size - offset - + sizeof(struct i2o_header))) + dbg("received mfa payload out of bounds\n"); + else + ibmasm_receive_message(sp, &msg->data, data_size); + } else { + dbg("received mfa header out of bounds\n"); + } } else dbg("didn't get a valid MFA\n"); =20 diff --git a/drivers/misc/ibmasm/lowlevel.h b/drivers/misc/ibmasm/lowlevel.h index 970d30478c7b..83b20b1d7021 100644 --- a/drivers/misc/ibmasm/lowlevel.h +++ b/drivers/misc/ibmasm/lowlevel.h @@ -13,6 +13,9 @@ #define __IBMASM_CONDOR_H__ =20 #include +#include +#include +#include "i2o.h" =20 #define VENDORID_IBM 0x1014 #define DEVICEID_RSA 0x010F @@ -118,9 +121,18 @@ static inline void set_mfa_inbound(void __iomem *base_= address, u32 mfa) writel(mfa, base_address + INBOUND_QUEUE_PORT); } =20 -static inline struct i2o_message *get_i2o_message(void __iomem *base_addre= ss, u32 mfa) -{ - return (struct i2o_message *)(GET_MFA_ADDR(mfa) + base_address); -} +/** + * get_i2o_message - Convert MFA to i2o_message pointer with bounds check + * @base_address: BAR 0 virtual address + * @mapped_size: actual size of BAR 0 mapping + * @mfa: Message Frame Address from hardware + * @msg_size: Required size of the message (header + payload) + * + * Returns NULL if the offset derived from @mfa does not fit within + * the mapped BAR (including the i2o_message header). + */ +struct i2o_message *get_i2o_message(void __iomem *base_address, + resource_size_t mapped_size, + u32 mfa, size_t msg_size); =20 #endif /* __IBMASM_CONDOR_H__ */ --=20 2.34.1