Re: [PATCH v3] PCI: endpoint: pci-epf-vntb: Honor MSI-X selection

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] pci: epf-vntb: missing msix_capable check leads to remote DoS
--

commit f3657c59adbc44294a8ce54de921ee0a386471b0
Author: Koichiro Den <den@valinux.co.jp>
Subject: PCI: endpoint: pci-epf-vntb: Honor MSI-X selection

This commit modifies the vNTB endpoint function to configure MSI-X when
supported by the hardware and uses the selected type for peer doorbells.
It allocates the MSI-X Table and PBA in the config BAR and configures
db_count entries.

> diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c
> --- a/drivers/pci/endpoint/functions/pci-epf-vntb.c
> +++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c

[ ... ]

> @@ -308,6 +310,7 @@ static void epf_ntb_cmd_handler(struct work_struct *work)
>  
>  	switch (command) {
>  	case COMMAND_CONFIGURE_DOORBELL:
> +		ntb->peer_msix = argument & MSIX_ENABLE;

[Severity: High]
Does this allow the remote host to unconditionally enable MSI-X locally?

Since this takes the MSIX_ENABLE flag directly from the remote host's 
argument, could it bypass the local endpoint's hardware capabilities check 
for epc_features->msix_capable?

>  		ctrl->command_status = COMMAND_STATUS_OK;
>  		break;
>  	case COMMAND_TEARDOWN_DOORBELL:

[ ... ]

> @@ -1540,6 +1561,7 @@ static void vntb_epf_peer_db_work(struct work_struct *work)
>  
>  	func_no = epf->func_no;
>  	vfunc_no = epf->vfunc_no;
> +	irq_type = ntb->peer_msix ? PCI_IRQ_MSIX : PCI_IRQ_MSI;
>  
>  	/*
>  	 * Drain doorbells from peer_db_pending in snapshots (atomic64_xchg()).

[ ... ]

> @@ -1573,7 +1595,7 @@ static void vntb_epf_peer_db_work(struct work_struct *work)
>  			db_bits &= ~BIT_ULL(db_bit);
>  
>  			ret = pci_epc_raise_irq(epf->epc, func_no, vfunc_no,
> -						PCI_IRQ_MSI, interrupt_num);
> +						irq_type, interrupt_num);

[Severity: High]
Can this cause a crash in the endpoint controller driver if MSI-X is not
actually supported locally?

If the remote host requests MSI-X but the local endpoint does not support
it, pci_epc_set_msix() will never be called to initialize the local MSI-X
table.

When vntb_epf_peer_db_work() later calls pci_epc_raise_irq() with
PCI_IRQ_MSIX based on the unvalidated ntb->peer_msix flag, will
the underlying controller drivers (like DesignWare) attempt to read
uninitialized hardware BIR and table offsets? Could this result in
dereferencing a NULL or out-of-bounds ep_func->epf_bar[bir]?

>  			if (ret)
>  				dev_err(&epf->dev,
>  					"Failed to raise IRQ for interrupt_num %u: %d\n",

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919172021.1055451-1-den@valinux.co.jp?part=1