From: Krzysztof Wilczyński <kwilczynski@kernel.org> mainline inclusion from mainline-v7.2-rc1 commit 25ec7f57deceec633f27bc93b615f951e2ade814 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20143 CVE: CVE-2026-97505 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- Currently, the __resource_resize_store() allows writing to the resourceN_resize sysfs attribute to change a BAR's size without checking for capabilities, currently relying only on the file access check. Resizing a BAR modifies PCI device configuration and can disrupt active drivers. After the upcoming conversion to static attributes, it will also trigger resource file updates via sysfs_update_groups(). Add a CAP_SYS_ADMIN check to prevent unprivileged users from performing BAR resize operations. Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Tested-by: Shivaprasad G Bhat <sbhat@linux.ibm.com> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Link: https://patch.msgid.link/20260508043543.217179-6-kwilczynski@kernel.org Conflicts: drivers/pci/pci-sysfs.c [The resize show/store helpers __resource_resize_show() and __resource_resize_store() don't exist in 6.6; the store logic is still open-coded in the pci_dev_resource_resize_attr() macro, so add the CAP_SYS_ADMIN check to resource##n##_resize_store() instead.] Signed-off-by: Zhang Hongtao <zhanghongtao35@huawei.com> --- drivers/pci/pci-sysfs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c index 8cfc2befbedfe..a899a1036ef04 100644 --- a/drivers/pci/pci-sysfs.c +++ b/drivers/pci/pci-sysfs.c @@ -1476,6 +1476,9 @@ static ssize_t resource##n##_resize_store(struct device *dev, \ int ret, i; \ u16 cmd; \ \ + if (!capable(CAP_SYS_ADMIN)) \ + return -EPERM; \ + \ if (kstrtoul(buf, 0, &size) < 0) \ return -EINVAL; \ \ -- 2.43.0