Re: [PATCH v15 12/16] PCI/CXL: Reject reset with unsafe function scope

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] pci: CXL reset restriction fails to reject VFs, allowing device-wide resets
--

commit bc92caba866b3736b7ca2232519b796c40f058e5
Author: Srirangan Madhavan <smadhavan@nvidia.com>

PCI/CXL: Reject reset with unsafe function scope

The per-device PCI reset interface must not reset sibling functions.
Reject cxl_reset and cxl_bus for multifunction devices and PFs with
enabled VFs.

Link: https://lore.kernel.org/linux-cxl/20260626160846.426e71b6@nvidia.com/
Link: https://lore.kernel.org/linux-cxl/6a50441e2bb5e_3cabcb1003e@djbw-dev.notmuch/

> diff --git a/drivers/pci/cxl.c b/drivers/pci/cxl.c
> index 3da8b316857f1..eccdb57945feb 100644
> --- a/drivers/pci/cxl.c
> +++ b/drivers/pci/cxl.c
> @@ -496,6 +496,9 @@ int cxl_reset_function(struct pci_dev *pdev, bool probe)
>  	    !(ctrl & PCI_DVSEC_CXL_MEM_ENABLE))
>  		return -ENOTTY;
>  
> +	if (pdev->multifunction || pci_num_vf(pdev))
> +		return -ENOTTY;

[Severity: High]
Does this check fail to reject Virtual Functions (VFs)?

Since VFs are initialized as single-function (pdev->multifunction = 0) and
pci_num_vf(pdev) returns 0 for non-PF devices, this restriction appears to be
bypassed for VFs. 

If the CXL 3.0+ hardware exposes the CXL DVSEC on the VF, triggering a reset
on a VF would bypass this check and reset the entire CXL endpoint, disrupting
the PF and all sibling VFs. Should this check also include pdev->is_virtfn?

> +
>  	if (probe)
>  		return 0;
>  
> diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
> index b2879a6be5f80..fe611340f5ab1 100644
> --- a/drivers/pci/pci.c
> +++ b/drivers/pci/pci.c
> @@ -5026,6 +5026,9 @@ static int cxl_reset_bus_function(struct pci_dev *dev, bool probe)
>  	if (!dvsec)
>  		return -ENOTTY;
>  
> +	if (dev->multifunction || pci_num_vf(dev))
> +		return -ENOTTY;

[Severity: High]
Similarly, does this bus reset check allow VFs to bypass the restriction and
inadvertently trigger a bus reset affecting sibling functions?

> +
>  	if (probe)
>  		return 0;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261011021422.3428136-1-smadhavan@nvidia.com?part=12