DF-2372
Undefined-behavior bit shift zeroes all 32-bit PCI config reads via ACPI
Summary
AcpiOsReadPciConfiguration computes width mask as *Value &= (1 << (bytes * 8)) - 1 with bytes and 1 of type int. For Width=32 this is 1 << 32 which is UB because shift count equals bit-width of int. On x86-64 emitted shl masks count to 5 bits so expression evaluates to (1 << 0) - 1 == 0 and subsequent &= destroys correctly-read value forcing every 32-bit PCI config read through ACPI to return 0. Mask fully redundant for valid widths (pci_cfgregread returns clean u_int32_t). AcpiExPciConfigSpaceHandler performs NO width validation before calling this function. Impact: AML makes incorrect decisions misdetecting PCI devices wrong power-state transitions potential panic. No memory corruption info leak or privilege escalation.
No comments yet.