[PATCH] PCI: fix out-of-bounds stack access

[Arnd Bergmann]

From: Arnd Bergmann <arnd@xxxxxxxx>

The newly added PCI_FIND_NEXT_EXT_CAP function calls a helper that
stores a result using a 32-bit pointer, but passes a shorter local
variable into it. gcc-15 warns about this undefined behavior:

In function 'cdns_pcie_read_cfg',
    inlined from 'cdns_pcie_find_capability' at drivers/pci/controller/cadence/pcie-cadence.c:31:9:
drivers/pci/controller/cadence/pcie-cadence.c:22:22: error: write of 32-bit data outside the bound of destination object, data truncated into 8-bit [-Werror=extra]
   22 |                 *val = cdns_pcie_readb(pcie, where);
      |                 ~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In function 'dw_pcie_read_cfg',
    inlined from 'dw_pcie_find_capability' at drivers/pci/controller/dwc/pcie-designware.c:234:9:
drivers/pci/controller/dwc/pcie-designware.c:225:22: error: write of 32-bit data outside the bound of destination object, data truncated into 8-bit [-Werror=extra]
  225 |                 *val = dw_pcie_readb_dbi(pci, where);
      |                 ~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Change the macro to remove the invalid cast and extend the target
variables as needed.

Fixes: 1b07388f32e1 ("PCI: Refactor extended capability search into PCI_FIND_NEXT_EXT_CAP()")
Signed-off-by: Arnd Bergmann <arnd@xxxxxxxx>
---
 drivers/pci/pci.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index da5912c2017c..ac954584d991 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -109,17 +109,17 @@ int pci_bus_read_config(void *priv, unsigned int devfn, int where, u32 size,
 ({									\
 	int __ttl = PCI_FIND_CAP_TTL;					\
 	u8 __id, __found_pos = 0;					\
-	u8 __pos = (start);						\
-	u16 __ent;							\
+	u32 __pos = (start);						\
+	u32 __ent;							\
 									\
-	read_cfg(args, __pos, 1, (u32 *)&__pos);			\
+	read_cfg(args, __pos, 1, &__pos);				\
 									\
 	while (__ttl--) {						\
 		if (__pos < PCI_STD_HEADER_SIZEOF)			\
 			break;						\
 									\
 		__pos = ALIGN_DOWN(__pos, 4);				\
-		read_cfg(args, __pos, 2, (u32 *)&__ent);		\
+		read_cfg(args, __pos, 2, &__ent);			\
 									\
 		__id = FIELD_GET(PCI_CAP_ID_MASK, __ent);		\
 		if (__id == 0xff)					\
-- 
2.39.5