Re: [PATCH v5 4/9] vfio/pci: Add a helper to create a DMABUF for a BAR-map VMA

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Missing bounds check on `res_index` before calling `pcim_p2pdma_provider()` leads to out-of-bounds array access.
--

--- Patch [4]: [PATCH v5 4/9] vfio/pci: Add a helper to create a DMABUF for a BAR-map VMA ---
commit 733300e7a6e7bd6d5e79581e31e2eac09e4e5c22
Author: Matt Evans <matt@ozlabs.org>

vfio/pci: Add a helper to create a DMABUF for a BAR-map VMA

This commit adds a helper function, vfio_pci_core_mmap_prep_dmabuf(), to
create a single-range DMABUF for mapping a PCI BAR. It also refactors the
existing vfio_pci_core_feature_dma_buf() to extract common export logic.

> diff --git a/drivers/vfio/pci/vfio_pci_dmabuf.c b/drivers/vfio/pci/vfio_pci_dmabuf.c
> index 7c047400dfd16..74c02794bfe28 100644
> --- a/drivers/vfio/pci/vfio_pci_dmabuf.c
> +++ b/drivers/vfio/pci/vfio_pci_dmabuf.c

[ ... ]

> @@ -460,6 +473,75 @@ int vfio_pci_core_feature_dma_buf(struct vfio_pci_core_device *vdev, u32 flags,
>  	return ret;
>  }
>  
> +int vfio_pci_core_mmap_prep_dmabuf(struct vfio_pci_core_device *vdev,
> +				   struct vm_area_struct *vma,
> +				   u64 phys_start, u64 req_len,
> +				   unsigned int res_index)
> +{
> +	struct vfio_pci_dma_buf *priv;

[ ... ]

> +	priv->vdev = vdev;
> +	priv->size = req_len;
> +	priv->nr_ranges = 1;
> +	priv->vma_pgoff_adjust = vma_pgoff;
> +	priv->provider = pcim_p2pdma_provider(vdev->pdev, res_index);

[Severity: Medium]
Is a bounds check needed on res_index before calling pcim_p2pdma_provider()?

If a caller passes an index like VFIO_PCI_ROM_REGION_INDEX (6) or higher, 
pcim_p2pdma_provider() will index the mem[PCI_STD_NUM_BARS] array out of
bounds, returning an invalid pointer. 

This invalid pointer could later be dereferenced by pci_p2pdma_map_type() 
in dma_buf_phys_vec_to_sgt(), which might lead to memory corruption or crashes.

> +	if (!priv->provider) {
> +		ret = -EINVAL;
> +		goto err_free_phys;
> +	}
> +
> +	priv->phys_vec[0].paddr = phys_start + ((u64)vma_pgoff << PAGE_SHIFT);
> +	priv->phys_vec[0].len = priv->size;

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260715174737.15287-1-matt@ozlabs.org?part=4