Re: [PATCH v7 3/9] PCI: endpoint: pci-epf-test: Use dmaenigne_prep_config_single() to simplify code

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unvalidated `size` from PCIe test registers leads to arbitrarily large `kzalloc` allocations, potentially triggering kernel warnings or panics.
--

commit a2e73aaa3ad55ca4f65ceeb2cf567d9f9ac1f014
Author: Frank Li <Frank.Li@nxp.com>

PCI: endpoint: pci-epf-test: Use dmaenigne_prep_config_single() to simplify code

This commit simplifies the DMA configuration code by replacing
dmaengine_slave_config() and dmaengine_prep_slave_single() with a single
call to dmaengine_prep_config_single().

> diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
> --- a/drivers/pci/endpoint/functions/pci-epf-test.c
> +++ b/drivers/pci/endpoint/functions/pci-epf-test.c
> @@ -182,12 +182,8 @@ static int pci_epf_test_data_transfer(struct pci_epf_test *epf_test,
>  		else
>  			sconf.src_addr = dma_remote;
>  
> -		if (dmaengine_slave_config(chan, &sconf)) {
> -			dev_err(dev, "DMA slave config fail\n");
> -			return -EIO;
> -		}
> -		tx = dmaengine_prep_slave_single(chan, dma_local, len, dir,
> -						 flags);
> +		tx = dmaengine_prep_config_single(chan, dma_local, len,
> +						  dir, flags, &sconf);

[Severity: High]
This is a pre-existing issue, but I noticed a potential problem with how the
len parameter is handled by the callers of this transfer code.

The functions pci_epf_test_copy(), pci_epf_test_read(), and
pci_epf_test_write() read a 32-bit size value directly from the memory-mapped
reg->size register, which is controlled by an external PCIe host.

This raw size is then passed directly to kzalloc() without any bounds checking
or validation.

Could this allow a malicious or misconfigured PCIe host to pass an arbitrarily
large size to kzalloc(), triggering a page allocator warning and stack trace
that might remotely crash the endpoint kernel if it is configured with
panic_on_warn?

>  	} else {
>  		tx = dmaengine_prep_dma_memcpy(chan, dma_dst, dma_src, len,
>  					       flags);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260521-dma_prep_config-v7-0-1f73f4899883@nxp.com?part=3