HID: amd_sfh: Validate BAR 2 as memory-mapped I/O in probe

[PATCH] HID: amd_sfh: Validate BAR 2 as memory-mapped I/O in probe

Posted by Preetam Sundar Das 1 month, 2 weeks ago

Syzbot reported a page fault in amd_mp2_pci_probe(). The fuzzer creates
a malicious PCI device where BAR 2 is defined as an I/O port rather
than a memory-mapped I/O (MMIO) region.

The driver previously assumed BAR 2 would always be MMIO and blindly
passed the I/O port address to readl(), causing a fatal page fault
when the CPU attempted to read from restricted memory.

Fix this by explicitly checking the PCI resource flags after waking
the device. If BAR 2 is not an IORESOURCE_MEM region, safely reject
the device with -EINVAL to prevent the panic.

Fixes: 4f567b9f8141 ("SFH: PCIe driver to add support of AMD sensor fusion hub")
Reported-by: syzbot+4eadd4dfe9e66522bae8@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?id=227a9acbe565367eb7a1277b47115df8706d9a12

Signed-off-by: Preetam Sundar Das <daspreetam4@gmail.com>
---
 drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
index 4b81cebdc335..aef105a81570 100644
--- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
+++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
@@ -451,6 +451,9 @@ static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i
 	if (rc)
 		return rc;
 
+	if (!(pci_resource_flags(pdev, 2) & IORESOURCE_MEM))
+		return -EINVAL;
+
 	rc = pcim_iomap_regions(pdev, BIT(2), DRIVER_NAME);
 	if (rc)
 		return rc;
-- 
2.43.0

Re: [PATCH] HID: amd_sfh: Validate BAR 2 as memory-mapped I/O in probe

Posted by Jiri Kosina 2 weeks, 3 days ago

On Sat, 15 Aug 2026, Preetam Sundar Das wrote:

> Syzbot reported a page fault in amd_mp2_pci_probe(). The fuzzer creates
> a malicious PCI device where BAR 2 is defined as an I/O port rather
> than a memory-mapped I/O (MMIO) region.
> 
> The driver previously assumed BAR 2 would always be MMIO and blindly
> passed the I/O port address to readl(), causing a fatal page fault
> when the CPU attempted to read from restricted memory.
> 
> Fix this by explicitly checking the PCI resource flags after waking
> the device. If BAR 2 is not an IORESOURCE_MEM region, safely reject
> the device with -EINVAL to prevent the panic.
> 
> Fixes: 4f567b9f8141 ("SFH: PCIe driver to add support of AMD sensor fusion hub")
> Reported-by: syzbot+4eadd4dfe9e66522bae8@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?id=227a9acbe565367eb7a1277b47115df8706d9a12
> 
> Signed-off-by: Preetam Sundar Das <daspreetam4@gmail.com>

Basavaraj, can I please get your Ack/Reviewed-by on this one?

Thanks.

> ---
>  drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
> index 4b81cebdc335..aef105a81570 100644
> --- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
> +++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
> @@ -451,6 +451,9 @@ static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i
>  	if (rc)
>  		return rc;
>  
> +	if (!(pci_resource_flags(pdev, 2) & IORESOURCE_MEM))
> +		return -EINVAL;
> +
>  	rc = pcim_iomap_regions(pdev, BIT(2), DRIVER_NAME);
>  	if (rc)
>  		return rc;
> -- 
> 2.43.0
> 

-- 
Jiri Kosina
SUSE Labs

Re: [PATCH] HID: amd_sfh: Validate BAR 2 as memory-mapped I/O in probe

Posted by Basavaraj Natikar 2 weeks, 3 days ago

Hi Jiri,


On 9/11/2026 7:52 PM, Jiri Kosina wrote:
> On Sat, 15 Aug 2026, Preetam Sundar Das wrote:
>
>> Syzbot reported a page fault in amd_mp2_pci_probe(). The fuzzer creates
>> a malicious PCI device where BAR 2 is defined as an I/O port rather
>> than a memory-mapped I/O (MMIO) region.
>>
>> The driver previously assumed BAR 2 would always be MMIO and blindly
>> passed the I/O port address to readl(), causing a fatal page fault
>> when the CPU attempted to read from restricted memory.
>>
>> Fix this by explicitly checking the PCI resource flags after waking
>> the device. If BAR 2 is not an IORESOURCE_MEM region, safely reject
>> the device with -EINVAL to prevent the panic.
>>
>> Fixes: 4f567b9f8141 ("SFH: PCIe driver to add support of AMD sensor fusion hub")
>> Reported-by: syzbot+4eadd4dfe9e66522bae8@syzkaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?id=227a9acbe565367eb7a1277b47115df8706d9a12
>>
>> Signed-off-by: Preetam Sundar Das <daspreetam4@gmail.com>
> Basavaraj, can I please get your Ack/Reviewed-by on this one?

This is already covered in below patch

https://lore.kernel.org/all/7f8690bc-17c7-45e7-bacd-a341b2ef0a4b@amd.com/

Thanks,
--
Basavaraj

>
> Thanks.
>
>> ---
>>   drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 3 +++
>>   1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
>> index 4b81cebdc335..aef105a81570 100644
>> --- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
>> +++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
>> @@ -451,6 +451,9 @@ static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i
>>   	if (rc)
>>   		return rc;
>>   
>> +	if (!(pci_resource_flags(pdev, 2) & IORESOURCE_MEM))
>> +		return -EINVAL;
>> +
>>   	rc = pcim_iomap_regions(pdev, BIT(2), DRIVER_NAME);
>>   	if (rc)
>>   		return rc;
>> -- 
>> 2.43.0
>>