Re: [PATCH v5 3/3] PCI: cadence: Add LGA IP debugfs for LTSSM status

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Out-of-bounds memory read in cdns_pcie_lga_ltssm_status_string due to incorrect prefix length subtraction.
--

commit f6b71b7c026fc3d8d383a59dcd6b10992b1a66e1
Author: Hans Zhang <18255117159@163.com>

PCI: cadence: Add LGA IP debugfs for LTSSM status

Extend debugfs support to LGA-based Cadence PCIe controllers. The
'ltssm_status' file now works for both HPA and LGA IP by selecting the
appropriate register access based on the 'is_hpa' flag.

> diff --git a/drivers/pci/controller/cadence/pcie-cadence-debugfs.c b/drivers/pci/controller/cadence/pcie-cadence-debugfs.c
> --- a/drivers/pci/controller/cadence/pcie-cadence-debugfs.c
> +++ b/drivers/pci/controller/cadence/pcie-cadence-debugfs.c
> @@ -13,6 +13,58 @@
>  
>  #define CDNS_DEBUGFS_BUF_MAX		128
>  
> +static const char *cdns_pcie_lga_ltssm_status_string(enum cdns_pcie_lga_ltssm ltssm)
> +{
> +	const char *str;
> +
> +	switch (ltssm) {
> +#define CDNS_PCIE_LGA_LTSSM_NAME(n) case n: str = #n; break
[ ... ]
> +	CDNS_PCIE_LGA_LTSSM_NAME(CDNS_PCIE_LGA_RECOVERY_IDLE);
> +	CDNS_PCIE_LGA_LTSSM_NAME(CDNS_PCIE_LGA_L0);
[ ... ]
> +	default:
> +		str = "CDNS_PCIE_LGA_LTSSM_UNKNOWN";
> +		break;
> +	}
> +
> +	return str + strlen("CDNS_PCIE_LGA_LTSSM_");

Can this cause an out-of-bounds memory read?

The stringified enum values, such as "CDNS_PCIE_LGA_L0", do not contain the
"LTSSM_" portion in their names. For example, "CDNS_PCIE_LGA_L0" is 16
characters long.

However, the return statement advances the string pointer by
strlen("CDNS_PCIE_LGA_LTSSM_"), which is 20 bytes.

Since L0 is the normal operational state of the PCIe link, could reading the
debugfs file while in this state advance the pointer past the null
terminator and leak adjacent memory into the output?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260515145747.129635-1-18255117159@163.com?part=3