Re: [PATCH v3 1/5] PCI: endpoint: Define endpoint DMA BAR metadata format

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The endpoint DMA BAR metadata format contains an inherent limit mismatch between the `metadata length` field and the maximum possible size of the tables it describes.
--

commit 8e3a71eaeea3ed7cc589bce08e6fd2a630ca1075
Author: Koichiro Den <den@valinux.co.jp>

PCI: endpoint: Define endpoint DMA BAR metadata format

This commit defines a BAR-resident metadata format for endpoint functions
that expose an endpoint-integrated DMA controller to a PCI host.

> diff --git a/include/linux/pci-ep-dma.h b/include/linux/pci-ep-dma.h
> new file mode 100644
> index 0000000000000..c5fd7aab2101f
> --- /dev/null
> +++ b/include/linux/pci-ep-dma.h

[ ... ]

> +#define PCI_EP_DMA_METADATA_HDR_LEN		0x1c
> +
> +#define PCI_EP_DMA_METADATA_HDR			0x04
> +#define  PCI_EP_DMA_METADATA_HDR_REV		GENMASK(7, 0)
> +#define  PCI_EP_DMA_METADATA_HDR_LEN_FIELD	GENMASK(31, 16)
> +
> +#define PCI_EP_DMA_METADATA_CTRL		0x08
> +#define  PCI_EP_DMA_METADATA_CTRL_REG_BAR	GENMASK(2, 0)
> +#define  PCI_EP_DMA_METADATA_CTRL_WR_CH_COUNT	GENMASK(10, 3)
> +#define  PCI_EP_DMA_METADATA_CTRL_RD_CH_COUNT	GENMASK(18, 11)
> +#define  PCI_EP_DMA_METADATA_CTRL_CH_ENTRY_SIZE	GENMASK(26, 19)

[Severity: Medium]
Could this layout result in the total computed size exceeding the 16-bit
length field capacity?

The PCI_EP_DMA_METADATA_HDR_LEN_FIELD defines a 16-bit metadata length
field (maximum 65,535 bytes). However, the format also specifies an 8-bit
write channel count (up to 255), an 8-bit read channel count (up to 255),
and an 8-bit channel entry size (up to 255 bytes). 

If an endpoint were to specify these maximum values, the total computed size
could reach 130,078 bytes (a 28 byte header plus 510 channels at 255 bytes
each). This exceeds the maximum value that the 16-bit metadata length
field can represent.

Would this ABI inconsistency allow a malicious endpoint to craft a payload
where the table bounds exceed the reported length, potentially leading to
out-of-bounds reads in future host drivers if they map memory based on the
length but iterate using the channel counts?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260620170438.3756593-1-den@valinux.co.jp?part=1