[xen staging] x86/pci: prevent cross-device accesses in pci_mmcfg_{read,write}()

[patchbot@xxxxxxx]

commit 6acdfad3da51aa7ed716bee9bf7a39bba1fe47f7
Author:     Roger Pau Monne <roger@xxxxxxxxxxxxxx>
AuthorDate: Thu Aug 6 16:44:19 2026 +0200
Commit:     Roger Pau Monne <roger@xxxxxxxxxxxxxx>
CommitDate: Wed Aug 26 11:50:42 2026 +0200

    x86/pci: prevent cross-device accesses in pci_mmcfg_{read,write}()
    
    Introduce a specific check that prevents an accesses from spilling across
    two devices.
    
    Signed-off-by: Roger Pau Monné <roger@xxxxxxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Stewart Hildebrand <stewart.hildebrand@xxxxxxx>
---
 xen/arch/x86/x86_64/mmconfig_64.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/x86_64/mmconfig_64.c 
b/xen/arch/x86/x86_64/mmconfig_64.c
index 940cf6d747..91b1a398e6 100644
--- a/xen/arch/x86/x86_64/mmconfig_64.c
+++ b/xen/arch/x86/x86_64/mmconfig_64.c
@@ -61,7 +61,8 @@ int pci_mmcfg_read(unsigned int seg, unsigned int bus,
     char __iomem *addr;
 
     /* Why do we have this when nobody checks it. How about a BUG()!? -AK */
-    if (unlikely((bus > 255) || (devfn > 255) || (reg > 4095))) {
+    if (unlikely((bus > 255) || (devfn > 255) ||
+                 (reg + len > PCI_CFG_SPACE_EXP_SIZE))) {
 err:        *value = -1;
         return -EINVAL;
     }
@@ -91,7 +92,8 @@ int pci_mmcfg_write(unsigned int seg, unsigned int bus,
     char __iomem *addr;
 
     /* Why do we have this when nobody checks it. How about a BUG()!? -AK */
-    if (unlikely((bus > 255) || (devfn > 255) || (reg > 4095)))
+    if (unlikely((bus > 255) || (devfn > 255) ||
+                 (reg + len > PCI_CFG_SPACE_EXP_SIZE)))
         return -EINVAL;
 
     addr = pci_dev_base(seg, bus, devfn);
--
generated by git-patchbot for /home/xen/git/xen.git#staging