Re: [PATCH v7 04/10] PCI: endpoint: Add API to delegate EPC DMA channels to the host

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] `pci_epc_reclaim_dma_chan()` fails to validate the `epc` pointer for `ERR_PTR` values and omits function number bounds checks.
--

--- Patch [4]: [PATCH v7 04/10] PCI: endpoint: Add API to delegate EPC DMA channels to the host ---
commit de98f70ea5d6f77029b0c89f0e6b02055a9ff0a1
Author: Koichiro Den <den@valinux.co.jp>

PCI: endpoint: Add API to delegate EPC DMA channels to the host

This commit introduces pci_epc_delegate_dma_chan() and 
pci_epc_reclaim_dma_chan() to allow endpoint functions to expose an 
integrated DMA controller to the host. The endpoint reserves the local DMA 
engine channel and passes it to the backend. Reclaiming allows the caller 
to specify whether the hardware needs to be quiesced before local ownership 
is restored.

> diff --git a/drivers/pci/endpoint/pci-epc-core.c b/drivers/pci/endpoint/pci-epc-core.c
> index 831b40458dcd8..d0bcf3dc7039b 100644
> --- a/drivers/pci/endpoint/pci-epc-core.c
> +++ b/drivers/pci/endpoint/pci-epc-core.c

[ ... ]

> +void pci_epc_reclaim_dma_chan(struct pci_epc *epc, u8 func_no, u8 vfunc_no,
> +			      struct dma_chan *chan, bool quiesce)
> +{
> +	if (!epc || !chan || !epc->ops->reclaim_dma_chan)
> +		return;

[Severity: Medium]
Should this use pci_epc_function_is_valid(epc, func_no, vfunc_no) here
instead of just checking !epc?

If an error pointer is passed during a teardown path, the !epc check will
fail to catch it, leading to a potential crash when dereferencing epc->ops.
Additionally, missing pci_epc_function_is_valid() means the func_no and
vfunc_no bounds are completely unvalidated before reaching the backend ops,
which could lead to out-of-bounds accesses in the backend drivers.

> +
> +	mutex_lock(&epc->lock);
> +	epc->ops->reclaim_dma_chan(epc, func_no, vfunc_no, chan, quiesce);
> +	mutex_unlock(&epc->lock);
> +}
> +EXPORT_SYMBOL_GPL(pci_epc_reclaim_dma_chan);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260813063757.3131865-1-den@valinux.co.jp?part=4