Re: [RFC 12/12] PCI: Reserve bus range for SIOV devices

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Malicious PCIe configuration can cause an integer underflow in bus numbering reservation, leading to broken bus allocation logic.
--

commit b3162f0225b56986a66cccbae6221dcaf9c28ae6
Author: Dimitri Daskalakis <daskald@meta.com>
Subject: PCI: Reserve bus range for SIOV devices

SDI routing IDs are computed from the PF's devfn plus an offset and
stride. When the stride pushes routing IDs past the current bus number,
additional bus numbers must be reserved during PCI bus scanning. This
commit adds pci_siov_bus_range() to compute the maximum number of
additional buses required, parallel to SR-IOV.

> diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
> index bebc32c8d374f..9ef6827ab3453 100644
> --- a/drivers/pci/probe.c
> +++ b/drivers/pci/probe.c
> @@ -3100,8 +3100,8 @@ static unsigned int pci_scan_child_bus_extend(struct pci_bus *bus,
>  	for (devnr = 0; devnr < PCI_MAX_NR_DEVS; devnr++)
>  		pci_scan_slot(bus, PCI_DEVFN(devnr, 0));
>  
> -	/* Reserve buses for SR-IOV capability */
> -	used_buses = pci_iov_bus_range(bus);
> +	/* Reserve buses for SR-IOV and SIOV capability */
> +	used_buses = max(pci_iov_bus_range(bus), pci_siov_bus_range(bus));

[Severity: High]
This isn't a bug introduced by this patch, but if pci_siov_bus_range()
returns a negative integer due to a 16-bit capability wraparound, won't
assigning it to the unsigned int used_buses result in an underflow?

If used_buses becomes a massive positive value, the subsequent
max += used_buses would wrap max backwards. This could corrupt the PCI
enumeration state, cause overlapping bus assignments, and potentially
bypass IOMMU isolation if RIDs collide.

>  	max += used_buses;
>  
>  	/*
> diff --git a/drivers/pci/siov.c b/drivers/pci/siov.c
> index 7372ce95714b2..6405a88300524 100644
> --- a/drivers/pci/siov.c
> +++ b/drivers/pci/siov.c

[ ... ]

> @@ -111,3 +111,24 @@ void pci_siov_release(struct pci_dev *dev)
> +int pci_siov_bus_range(struct pci_bus *bus)
> +{
> +	int max = 0;
> +	struct pci_dev *dev;
> +
> +	list_for_each_entry(dev, &bus->devices, bus_list) {
> +		if (!dev->siov)
> +			continue;
> +		if (dev->siov->max_SDI_buses > max)
> +			max = dev->siov->max_SDI_buses;
> +	}
> +
> +	return max ? max - bus->number : 0;

[Severity: High]
This is a pre-existing issue inherited from SR-IOV, but could a malicious
PCIe device provide offset and stride values that cause the 16-bit
capability to wrap around?

If max_SDI_buses wraps around and ends up strictly less than bus->number
(but non-zero), this subtraction yields a negative integer, leading to
the underflow in pci_scan_child_bus_extend() mentioned above.

> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260604150153.3619662-1-dimitri.daskalakis1@gmail.com?part=12