In the Linux kernel, the following vulnerability has been resolved:

ata: ahci: fail probe if BAR too small for claimed ports

When an AHCI controller is disabled in BIOS, its HOST CAP register may contain a bogus value, e.g. 0xFFFFFFFF.

Since CAP.NP (Number of Ports) is a zeroes based 5-bit register field, a value of 0x1f means 32 ports. If CAP.NP claims more ports than can physically fit within the mapped BAR region, accessing port registers beyond the BAR boundary causes a kernel panic.

Add validation in ahci init one() to check that the BAR size is sufficient for the number of ports claimed in CAP.NP. The check calculates the required MMIO size as:

required size = 0x100 (global registers) + max ports * 0x80

If required size exceeds the actual BAR size, the probe fails with -ENODEV, preventing the panic and providing a clear error message.

[cassel: commit log]