Re: [PATCH v3 10/13] dmaengine: dw-edma-pcie: Add register offset match flag

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The driver adds statically defined offsets to PCI BAR mapping pointers without validating them against the size of the mapped BAR, enabling out-of-bounds MMIO accesses.
--

commit ba4f6509ffb3ea527d21eedc70cede2c4bd0c13c
Author: Koichiro Den <den@valinux.co.jp>

dmaengine: dw-edma-pcie: Add register offset match flag

This commit adds a match-data flag for devices whose DMA register block
starts at an offset inside the mapped BAR. It applies this offset to the
register base during the PCIe probe.

> diff --git a/drivers/dma/dw-edma/dw-edma-pcie.c b/drivers/dma/dw-edma/dw-edma-pcie.c
> --- a/drivers/dma/dw-edma/dw-edma-pcie.c
> +++ b/drivers/dma/dw-edma/dw-edma-pcie.c
[ ... ]
> @@ -465,6 +466,8 @@ static int dw_edma_pcie_probe(struct pci_dev *pdev,
>  	chip->reg_base = pcim_iomap_table(pdev)[dma_data->rg.bar];
>  	if (!chip->reg_base)
>  		return -ENOMEM;
> +	if (match->flags & DW_EDMA_PCIE_F_REG_OFFSET)
> +		chip->reg_base += dma_data->rg.off;

[Severity: High]
This is a pre-existing issue, but since the new code adds another offset
here, could a malicious or malfunctioning PCIe device cause out-of-bounds
MMIO accesses by reporting an artificially small BAR size?

The driver maps the device BARs using pcim_iomap_regions(), which maps
exactly the size of the BAR as reported by the device during enumeration.
It then calculates pointers by adding statically defined offsets to the
mapped base address in dw_edma_pcie_probe() without bounds checks:

drivers/dma/dw-edma/dw-edma-pcie.c:dw_edma_pcie_probe() {
    ...
    ll_region->vaddr.io += ll_block->off;
    ...
    dt_region->vaddr.io += dt_block->off;
    ...
}

Does the driver need to verify that the mapped region is large enough to
contain the hardcoded offsets and sizes before adding them, to prevent
potential kernel panics or memory corruption when the DMA engine accesses
these pointers?

>  
>  	for (i = 0; i < chip->ll_wr_cnt && !dma_data->cfg_non_ll; i++) {
>  		struct dw_edma_region *ll_region = &chip->ll_region_wr[i];

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260620170040.3756043-1-den@valinux.co.jp?part=10