From: Hans Zhang <18255117159@163.com>
To: lpieralisi@kernel.org, jingoohan1@gmail.com, mani@kernel.org,
kwilczynski@kernel.org, bhelgaas@google.com, helgaas@kernel.org,
florian.fainelli@broadcom.com, jim2101024@gmail.com
Cc: robh@kernel.org, ilpo.jarvinen@linux.intel.com,
linux-arm-msm@vger.kernel.org,
linux-arm-kernel@lists.infradead.org,
linux-renesas-soc@vger.kernel.org,
claudiu.beznea.uj@bp.renesas.com,
linux-mediatek@lists.infradead.org, linux-tegra@vger.kernel.org,
linux-omap@vger.kernel.org,
bcm-kernel-feedback-list@broadcom.com, linux-pci@vger.kernel.org,
linux-kernel@vger.kernel.org, shawn.lin@rock-chips.com,
Hans Zhang <18255117159@163.com>
Subject: [PATCH v9 1/5] PCI: Add pcie_get_link_speed() helper for safe array access
Date: Sat, 14 Mar 2026 00:55:18 +0800 [thread overview]
Message-ID: <20260313165522.123518-2-18255117159@163.com> (raw)
In-Reply-To: <20260313165522.123518-1-18255117159@163.com>
The pcie_link_speed[] array is indexed by PCIe generation numbers
(1 = 2.5 GT/s, 2 = 5 GT/s, ...). Several drivers use it directly,
which can lead to out-of-bounds accesses if an invalid generation
number is used.
Introduce a helper function pcie_get_link_speed() that returns the
corresponding enum pci_bus_speed value for a given generation number,
or PCI_SPEED_UNKNOWN if the generation is out of range. This will
allow us to safely handle invalid values after the range check is
removed from of_pci_get_max_link_speed().
Signed-off-by: Hans Zhang <18255117159@163.com>
---
drivers/pci/pci.h | 2 ++
drivers/pci/probe.c | 16 ++++++++++++++++
2 files changed, 18 insertions(+)
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index 13d998fbacce..409aca7d737a 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -108,6 +108,8 @@ struct pcie_tlp_log;
PCI_EXP_DEVCTL_FERE | PCI_EXP_DEVCTL_URRE)
extern const unsigned char pcie_link_speed[];
+unsigned char pcie_get_link_speed(unsigned int speed);
+
extern bool pci_early_dump;
extern struct mutex pci_rescan_remove_lock;
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index bccc7a4bdd79..d6592898330c 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -783,6 +783,22 @@ const unsigned char pcie_link_speed[] = {
};
EXPORT_SYMBOL_GPL(pcie_link_speed);
+/**
+ * pcie_link_speed_value - Get speed value from PCIe generation number
+ * @speed: PCIe speed (1-based: 1 = 2.5GT, 2 = 5GT, ...)
+ *
+ * Returns the speed value (e.g., PCIE_SPEED_2_5GT) if @speed is valid,
+ * otherwise returns PCI_SPEED_UNKNOWN.
+ */
+unsigned char pcie_get_link_speed(unsigned int speed)
+{
+ if (speed >= ARRAY_SIZE(pcie_link_speed))
+ return PCI_SPEED_UNKNOWN;
+
+ return pcie_link_speed[speed];
+}
+EXPORT_SYMBOL_GPL(pcie_get_link_speed);
+
const char *pci_speed_string(enum pci_bus_speed speed)
{
/* Indexed by the pci_bus_speed enum */
--
2.34.1
next prev parent reply other threads:[~2026-03-13 16:57 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-13 16:55 [PATCH v9 0/5] PCI: of: Remove max-link-speed generation validation Hans Zhang
2026-03-13 16:55 ` Hans Zhang [this message]
2026-03-26 17:40 ` [PATCH v9 1/5] PCI: Add pcie_get_link_speed() helper for safe array access Manivannan Sadhasivam
2026-03-26 18:09 ` Bjorn Helgaas
2026-03-26 18:16 ` Bjorn Helgaas
2026-03-26 18:32 ` Manivannan Sadhasivam
2026-03-13 16:55 ` [PATCH v9 2/5] PCI: dwc: Use " Hans Zhang
2026-03-13 16:55 ` [PATCH v9 3/5] PCI: j721e: Validate max-link-speed from DT Hans Zhang
2026-03-13 16:55 ` [PATCH v9 4/5] PCI: controller: Validate max-link-speed Hans Zhang
2026-03-13 16:55 ` [PATCH v9 5/5] PCI: of: Remove max-link-speed generation validation Hans Zhang
2026-03-26 18:29 ` [PATCH v9 0/5] " Manivannan Sadhasivam
2026-03-27 16:42 ` Bjorn Helgaas
2026-03-29 14:47 ` Hans Zhang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260313165522.123518-2-18255117159@163.com \
--to=18255117159@163.com \
--cc=bcm-kernel-feedback-list@broadcom.com \
--cc=bhelgaas@google.com \
--cc=claudiu.beznea.uj@bp.renesas.com \
--cc=florian.fainelli@broadcom.com \
--cc=helgaas@kernel.org \
--cc=ilpo.jarvinen@linux.intel.com \
--cc=jim2101024@gmail.com \
--cc=jingoohan1@gmail.com \
--cc=kwilczynski@kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mediatek@lists.infradead.org \
--cc=linux-omap@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=linux-renesas-soc@vger.kernel.org \
--cc=linux-tegra@vger.kernel.org \
--cc=lpieralisi@kernel.org \
--cc=mani@kernel.org \
--cc=robh@kernel.org \
--cc=shawn.lin@rock-chips.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox