Re: [PATCH v12 1/6] PCI/TPH: Fix pcie_tph_get_st_table_loc() field extraction

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Exported functions pcie_tph_get_st_table_loc() and pcie_tph_get_st_table_size() do not verify that the device actually supports TPH (pdev->tph_cap != 0) before accessing the capability offset.
--

commit 778a377b4fe5a5811f9d4225d057f7de399a56a3
Author: Chengwen Feng <fengchengwen@huawei.com>

PCI/TPH: Fix pcie_tph_get_st_table_loc() field extraction

This commit fixes the ST table location detection in
pcie_tph_get_st_table_loc() by using bitwise AND with PCI_TPH_CAP_LOC_MASK
instead of FIELD_GET(). The function was designed to return raw
PCI_TPH_LOC_* values without shifting.

> diff --git a/drivers/pci/tph.c b/drivers/pci/tph.c
> index 91145e8d9d951..877cf556242b4 100644
> --- a/drivers/pci/tph.c
> +++ b/drivers/pci/tph.c
> @@ -170,7 +170,7 @@ u32 pcie_tph_get_st_table_loc(struct pci_dev *pdev)
>  
>  	pci_read_config_dword(pdev, pdev->tph_cap + PCI_TPH_CAP, &reg);

[Severity: High]
This is a pre-existing issue, but should this function verify that the device
actually supports TPH (pdev->tph_cap != 0) before reading the capability?

If a device lacks the TPH capability, pdev->tph_cap is 0, which results in a
read of the generic PCI Command & Status registers at offset 0x04. The ST
Table Location mask (bits 9-10) maps exactly to the Fast Back-to-Back Enable
and Interrupt Disable bits in the Command register.

If Interrupt Disable is set (which is standard for MSI/MSI-X devices), would
this incorrectly return PCI_TPH_LOC_MSIX (0x400)? If Fast Back-to-Back Enable
is set, it might return PCI_TPH_LOC_CAP (0x200) and then incorrectly extract
the table size from the PCI Status register in pcie_tph_get_st_table_size().

Since these are EXPORT_SYMBOL APIs, they can be called by external modules
that might not independently validate pdev->tph_cap. This could lead to
falsely detecting TPH support and allocating unnecessary shadow memory.

> -	return FIELD_GET(PCI_TPH_CAP_LOC_MASK, reg);
> +	return reg & PCI_TPH_CAP_LOC_MASK;
>  }
>  EXPORT_SYMBOL(pcie_tph_get_st_table_loc);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260526040830.52854-1-fengchengwen@huawei.com?part=1