Re: [RFC 02/12] PCI: Convert iov.c to pci_is_sriov_* helpers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Division by zero in pci_iov_vf_id() if the VF Stride is 0.
--

commit ef3219de5f4e200d2b4b6b2b9d4bac7ee1daf6b4
Author: Dimitri Daskalakis <daskald@meta.com>

PCI: Convert iov.c to pci_is_sriov_* helpers

This commit converts the dev->is_physfn and dev->is_virtfn checks in
drivers/pci/iov.c to use the pci_is_sriov_physfn() and
pci_is_sriov_virtfn() helpers instead.

> diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
> index 91ac4e37ecb9c..5de26057b99aa 100644
> --- a/drivers/pci/iov.c
> +++ b/drivers/pci/iov.c

[ ... ]

> @@ -42,7 +42,7 @@ int pci_iov_vf_id(struct pci_dev *dev)
>  {
>  	struct pci_dev *pf;
>  
> -	if (!dev->is_virtfn)
> +	if (!pci_is_sriov_virtfn(dev))
>  		return -EINVAL;
>  
>  	pf = pci_physfn(dev);

[Severity: High]
This is a pre-existing issue, but is there a potential divide-by-zero
risk in pci_iov_vf_id() when a device has only a single virtual function?

According to the PCI SR-IOV specification, if TotalVFs is 1, the VF Stride
is undefined and can be 0. While compute_max_vf_buses() correctly permits
a 0 stride when the number of VFs is 1 or fewer, the end of pci_iov_vf_id()
does an unconditional division:

int pci_iov_vf_id(struct pci_dev *dev)
{
	...
	pf = pci_physfn(dev);
	return (pci_dev_id(dev) - (pci_dev_id(pf) + pf->sriov->offset)) /
	       pf->sriov->stride;
}

Could this cause a kernel panic during the driver probe path when
enumerating fully compliant PCIe hardware with a 0 stride?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260604150153.3619662-1-dimitri.daskalakis1@gmail.com?part=2