From 47f84fcb067aca1cda4ea15fce9e59d7dd79abab Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= Date: Wed, 30 Sep 2026 13:06:08 +0200 Subject: [PATCH] x86/pci: prevent cross-device accesses in pci_mmcfg_{read,write}() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Introduce a specific check that prevents an accesses from spilling across two devices. Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Stewart Hildebrand master commit: 6acdfad3da51aa7ed716bee9bf7a39bba1fe47f7 master date: 2026-08-26 11:50:42 +0200 --- xen/arch/x86/x86_64/mmconfig_64.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/x86_64/mmconfig_64.c b/xen/arch/x86/x86_64/mmconfig_64.c index ffdc62700d..f86fc1c69c 100644 --- a/xen/arch/x86/x86_64/mmconfig_64.c +++ b/xen/arch/x86/x86_64/mmconfig_64.c @@ -61,7 +61,8 @@ int pci_mmcfg_read(unsigned int seg, unsigned int bus, char __iomem *addr; /* Why do we have this when nobody checks it. How about a BUG()!? -AK */ - if (unlikely((bus > 255) || (devfn > 255) || (reg > 4095))) { + if (unlikely((bus > 255) || (devfn > 255) || + (reg + len > PCI_CFG_SPACE_EXP_SIZE))) { err: *value = -1; return -EINVAL; } @@ -91,7 +92,8 @@ int pci_mmcfg_write(unsigned int seg, unsigned int bus, char __iomem *addr; /* Why do we have this when nobody checks it. How about a BUG()!? -AK */ - if (unlikely((bus > 255) || (devfn > 255) || (reg > 4095))) + if (unlikely((bus > 255) || (devfn > 255) || + (reg + len > PCI_CFG_SPACE_EXP_SIZE))) return -EINVAL; addr = pci_dev_base(seg, bus, devfn);