The thunderbolt driver can crash with a page fault if it binds to an arbitrary PCI device (e.g., via sysfs driver_override) that has an I/O port BAR at index 0 instead of an MMIO BAR. The driver maps this BAR without validating its type or size. When it attempts to read a Thunderbolt register at a large offset, the resulting I/O port cookie overflows the reserved PIO space on x86. This causes the generic ioread32() function to misinterpret the out-of-bounds I/O port cookie as a valid MMIO virtual address, leading to a direct dereference of an unmapped physical-like address and a page fault: BUG: unable to handle page fault for address: 00000000000556c0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page ... Call Trace: nhi_probe+0xcc/0x870 drivers/thunderbolt/nhi.c:1198 nhi_pci_probe+0x46b/0x580 drivers/thunderbolt/pci.c:479 local_pci_probe drivers/pci/pci-driver.c:332 [inline] pci_call_probe drivers/pci/pci-driver.c:394 [inline] __pci_device_probe drivers/pci/pci-driver.c:455 [inline] pci_device_probe+0x431/0xc90 drivers/pci/pci-driver.c:489 To fix this, add explicit validation in nhi_pci_probe() to ensure that BAR 0 is an MMIO resource and is large enough to contain all the NHI registers before attempting to map it. The NHI register space extends up to offset 0x39944 (REG_FW_STS), so checking for a minimum size of 0x40000 (256 KB) is appropriate. Fixes: 16603153666d ("thunderbolt: Add initial cactus ridge NHI support") Assisted-by: Gemini:gemini-3.7-flash Gemini:gemini-3.1-pro-preview syzbot Reported-by: syzbot+97999b836ee62ddb0181@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=97999b836ee62ddb0181 Link: https://syzkaller.appspot.com/ai_job?id=2570f821-2184-40c8-8bd7-344a30c18a13 To: "Yehezkel Bernat" To: "Andreas Noever" To: To: "Mika Westerberg" Cc: --- v2: - Define NHI_MIN_BAR_SIZE macro in nhi_regs.h instead of using a hardcoded value v1: https://lore.kernel.org/all/3b721f07-79ad-423c-9bd3-f945e97a1d9b@mail.kernel.org/T/ --- diff --git a/drivers/thunderbolt/nhi_regs.h b/drivers/thunderbolt/nhi_regs.h index d6a197fab..1feb0bfb0 100644 --- a/drivers/thunderbolt/nhi_regs.h +++ b/drivers/thunderbolt/nhi_regs.h @@ -140,6 +140,9 @@ struct ring_desc { #define REG_FW_STS_ICM_EN_INVERT BIT(1) #define REG_FW_STS_ICM_EN BIT(0) +/* Minimum BAR size to contain NHI registers */ +#define NHI_MIN_BAR_SIZE 0x40000 + /* ICL NHI VSEC registers */ /* FW ready */ diff --git a/drivers/thunderbolt/pci.c b/drivers/thunderbolt/pci.c index bbd186c29..fa69e4609 100644 --- a/drivers/thunderbolt/pci.c +++ b/drivers/thunderbolt/pci.c @@ -466,6 +466,14 @@ static int nhi_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) nhi->dev = dev; nhi->ops = (const struct tb_nhi_ops *)id->driver_data ?: &pci_nhi_default_ops; + /* Ensure BAR 0 is an MMIO resource */ + if (!(pci_resource_flags(pdev, 0) & IORESOURCE_MEM)) + return dev_err_probe(dev, -EINVAL, "BAR 0 is not an MMIO resource\n"); + + /* Ensure BAR 0 is large enough to contain the NHI registers */ + if (pci_resource_len(pdev, 0) < NHI_MIN_BAR_SIZE) + return dev_err_probe(dev, -EINVAL, "BAR 0 is too small\n"); + nhi->iobase = pcim_iomap_region(pdev, 0, "thunderbolt"); res = PTR_ERR_OR_ZERO(nhi->iobase); if (res) base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f -- This is an AI-generated patch subject to moderation. Reply with '#syz upstream' to Sign-off the patch as a human author and send it to the upstream kernel mailing lists. Reply with '#syz reject' to reject it ('#syz unreject' to undo). See https://goo.gle/syzbot-ai-patches for information about AI-generated patches. You can comment on the patch as usual, syzbot will try to address the comments and send a new version of the patch if necessary. syzbot engineers can be reached at syzkaller@googlegroups.com.