CVE-2026-80917

In the Linux kernel, the following vulnerability has been resolved:

PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems

On 32-bit systems the config space is too large to ioremap in one go, so pci ecam create() maps each bus segment separately and relies on the ->add bus callback (pci ecam add bus) to populate the per-bus mapping in cfg->winp[]. pci ecam map bus() then uses that mapping as the base for every config access.

The generic ECAM ops (pci generic ecam ops) already provide the ->add bus and ->remove bus callbacks, but the CAM (legacy) ops in pci-host-generic.c do not. As a result, on a 32-bit host using "pci-host-cam-generic" the per-bus mapping is never set up and the first config read dereferences a NULL base, crashing during bus enumeration:

Unable to handle kernel NULL pointer dereference at virtual address 00000800 Oops [#1] CPU: 0 PID: 1 Comm: swapper Not tainted 6.9.7+ #43 Hardware name: Digilent Nexys-Video-A7 RV32 (DT) epc : pci generic config read+0x40/0xb0 ra : pci generic config read+0x2c/0xb0 [] pci generic config read+0x40/0xb0 [] pci bus read config dword+0x50/0xb0 [] pci bus generic read dev vendor id+0x3c/0x1ec [] pci scan single device+0xa4/0x11c [] pci scan slot+0x9c/0x23c [] pci scan child bus extend+0x58/0x2f4 [] pci scan root bus bridge+0x64/0xe8 [] pci host probe+0x20/0xc8 [] pci host common probe+0x144/0x1e4

Fix this by giving the CAM ops the same ->add bus/->remove bus callbacks. Since pci ecam add bus() and pci ecam remove bus() are static to ecam.c, move the CAM ops definition there as pci generic cam ops (mirroring pci generic ecam ops) and export it for pci-host-generic.c to reference.

[mani: removed timestamp from log]