DF-5209
pci_iomap() treats pci_resource_start()'s -1 failure sentinel as a valid base and drives __ioremap_common() into BUG_ON panic for any absent/unallocatable BAR
Summary
The shim guards only base==0 but the getter signals failure with -1 - a missing/unallocatable BAR feeds ~0 into ioremap where BUG_ON(phys_addr & PAGE_MASK) is guaranteed true. Attach-time panic on quirky/malicious PCIe hardware; every in-tree caller is written to the NULL contract. Validate-both-sentinels fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5209 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 903 B | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5209
Confirmed kernel references
Detail
Evidence (decisive lines)
static trace in finding markdown
Verified recommended fix
see finding markdown
Verdict
untested (hardware-/root-gated; Low/Info per contract)
No comments yet.