Re: [PATCH net-next 2/8] eth: mpnic: add register init for the device

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] pci: missing pci_resource_len() check in mpnic_probe() allows OOB MMIO access
--

commit 647e9ec73143ec855da6fd69e03902213d836df8
Author: Mohsin Bashir <mohsin.bashr@gmail.com>

eth: mpnic: add register init for the device

This commit adds one-time register initialization for the mpnic device during
the probe process. It covers static configurations and pulses for zeroizing
on-chip SRAMs.

> diff --git a/drivers/net/ethernet/meta/mpnic/mpnic_init.c b/drivers/net/ethernet/meta/mpnic/mpnic_init.c
> new file mode 100644
> index 0000000000000..f8ebb19766731
> --- /dev/null
> +++ b/drivers/net/ethernet/meta/mpnic/mpnic_init.c

[ ... ]

> +static void mpnic_ro_init(struct mpnic_dev *mpd)
> +{
> +	u64 attr = mpd->relaxed_ord ? MPNIC_OB_ATTR_RO : 0;
> +
> +	mpnic_wr64(mpd, MPNIC_OB_ATTR_TDE_H, attr);
> +	mpnic_wr64(mpd, MPNIC_OB_ATTR_TDE_P, attr);
> +	mpnic_wr64(mpd, MPNIC_OB_ATTR_TDF, attr);
> +	mpnic_wr64(mpd, MPNIC_OB_ATTR_RBP_HPQ, attr);
> +	mpnic_wr64(mpd, MPNIC_OB_ATTR_RBP_PPQ, attr);
> +	mpnic_wr64(mpd, MPNIC_OB_ATTR_RDE_H, attr);
> +	mpnic_wr64(mpd, MPNIC_OB_ATTR_RDE_P, attr);

[Severity: High]
Can this write out of bounds of the mapped MMIO region if the PCI BAR is
unexpectedly small?

This function accesses MPNIC_OB_ATTR_RDE_P, which is at offset 0x2680068.
This requires the mapped region to be at least ~40MB.

Earlier in the initialization path, mpnic_probe() maps the PCI BAR via
pcim_iomap_region() without verifying if pci_resource_len() covers these
expected MMIO registers.

If a malicious or spoofed PCI device (e.g., connected via Thunderbolt)
advertises an artificially small BAR, the driver will map this short length
but unconditionally write to offsets far beyond the mapped boundary here.
This could cause an immediate page fault and system crash upon device
connection.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922-linux-mpnic-v1-0-236844f53072@gmail.com?part=2