[PATCH] PCI: endpoint: pci-epf-vntb: Check pci_epc_get_features() return value

[PATCH] PCI: endpoint: pci-epf-vntb: Check pci_epc_get_features() return value

[Alok Tiwari]

pci_epc_get_features() may return NULL for invalid function numbers or
if the EPC driver does not provide feature information. Other EPF drivers
such as pci-epf-ntb.c and pci-epf-test.c already handle this case.

Add a defensive NULL check to avoid a potential NULL pointer dereference.

No functional change intended.

Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
---
 drivers/pci/endpoint/functions/pci-epf-vntb.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c
index 20a400e83439..93943e4497a6 100644
--- a/drivers/pci/endpoint/functions/pci-epf-vntb.c
+++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c
@@ -438,6 +438,8 @@ static int epf_ntb_config_spad_bar_alloc(struct epf_ntb *ntb)
 	const struct pci_epc_features *epc_features = pci_epc_get_features(epf->epc,
 								epf->func_no,
 								epf->vfunc_no);
+	if (!epc_features)
+		return -EINVAL;
 	barno = ntb->epf_ntb_bar[BAR_CONFIG];
 	spad_count = ntb->spad_count;
 
@@ -489,6 +491,8 @@ static int epf_ntb_configure_interrupt(struct epf_ntb *ntb)
 	dev = &ntb->epf->dev;
 
 	epc_features = pci_epc_get_features(ntb->epf->epc, ntb->epf->func_no, ntb->epf->vfunc_no);
+	if (!epc_features)
+		return -EINVAL;
 
 	if (!(epc_features->msix_capable || epc_features->msi_capable)) {
 		dev_err(dev, "MSI or MSI-X is required for doorbell\n");
@@ -624,6 +628,8 @@ static int epf_ntb_db_bar_init(struct epf_ntb *ntb)
 	epc_features = pci_epc_get_features(ntb->epf->epc,
 					    ntb->epf->func_no,
 					    ntb->epf->vfunc_no);
+	if (!epc_features)
+		return -EINVAL;
 	barno = ntb->epf_ntb_bar[BAR_DB];
 	epf_bar = &ntb->epf->bar[barno];
 
@@ -852,6 +858,8 @@ static int epf_ntb_init_epc_bar(struct epf_ntb *ntb)
 	num_mws = ntb->num_mws;
 	dev = &ntb->epf->dev;
 	epc_features = pci_epc_get_features(ntb->epf->epc, ntb->epf->func_no, ntb->epf->vfunc_no);
+	if (!epc_features)
+		return -EINVAL;
 
 	/* These are required BARs which are mandatory for NTB functionality */
 	for (bar = BAR_CONFIG; bar <= BAR_MW1; bar++) {
-- 
2.50.1

Re: [PATCH] PCI: endpoint: pci-epf-vntb: Check pci_epc_get_features() return value

[Niklas Cassel]

On Tue, Feb 24, 2026 at 05:31:03AM -0800, Alok Tiwari wrote:
> pci_epc_get_features() may return NULL for invalid function numbers or
> if the EPC driver does not provide feature information. Other EPF drivers
> such as pci-epf-ntb.c and pci-epf-test.c already handle this case.
> 
> Add a defensive NULL check to avoid a potential NULL pointer dereference.
> 
> No functional change intended.
> 
> Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>

I think a better solution is to do like pci-epf-test.c, which calls
pci_epc_get_features() once in .bind() and if it fails, it fails bind(),
if it returns non-NULL, it caches the result:
https://github.com/torvalds/linux/blob/v6.19/drivers/pci/endpoint/functions/pci-epf-test.c#L1112-L1123

That way, all other functions do not need to NULL check
pci_epc_get_features(). (Instead it can use the cached value)

pci-epf-vntb.c should probably do something similar to avoid sprinkling
NULL checks all over pci-epf-vntb.c.

And, if there are any existing
if (!epc_features) return -EINVAL;

they can be removed once you've added the check in .bind().


Kind regards,
Niklas

Re: [PATCH] PCI: endpoint: pci-epf-vntb: Check pci_epc_get_features() return value

[Koichiro Den]

On Tue, Feb 24, 2026 at 05:31:03AM -0800, Alok Tiwari wrote:
> pci_epc_get_features() may return NULL for invalid function numbers or
> if the EPC driver does not provide feature information. Other EPF drivers
> such as pci-epf-ntb.c and pci-epf-test.c already handle this case.
> 
> Add a defensive NULL check to avoid a potential NULL pointer dereference.
> 
> No functional change intended.
> 
> Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
> ---
>  drivers/pci/endpoint/functions/pci-epf-vntb.c | 8 ++++++++
>  1 file changed, 8 insertions(+)

Hi Alok,

Thanks for picking this up. I have a similar view to Niklas [1], so if you
agree, I'll wait for a respin.
[1] https://lore.kernel.org/linux-pci/hew5wbd4fkaqlykv763wss3jirv52b5fyypzirvywysldbw5hh@qpds3syxgxgc/

Best regards,
Koichiro

> 
> diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c
> index 20a400e83439..93943e4497a6 100644
> --- a/drivers/pci/endpoint/functions/pci-epf-vntb.c
> +++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c
> @@ -438,6 +438,8 @@ static int epf_ntb_config_spad_bar_alloc(struct epf_ntb *ntb)
>  	const struct pci_epc_features *epc_features = pci_epc_get_features(epf->epc,
>  								epf->func_no,
>  								epf->vfunc_no);
> +	if (!epc_features)
> +		return -EINVAL;
>  	barno = ntb->epf_ntb_bar[BAR_CONFIG];
>  	spad_count = ntb->spad_count;
>  
> @@ -489,6 +491,8 @@ static int epf_ntb_configure_interrupt(struct epf_ntb *ntb)
>  	dev = &ntb->epf->dev;
>  
>  	epc_features = pci_epc_get_features(ntb->epf->epc, ntb->epf->func_no, ntb->epf->vfunc_no);
> +	if (!epc_features)
> +		return -EINVAL;
>  
>  	if (!(epc_features->msix_capable || epc_features->msi_capable)) {
>  		dev_err(dev, "MSI or MSI-X is required for doorbell\n");
> @@ -624,6 +628,8 @@ static int epf_ntb_db_bar_init(struct epf_ntb *ntb)
>  	epc_features = pci_epc_get_features(ntb->epf->epc,
>  					    ntb->epf->func_no,
>  					    ntb->epf->vfunc_no);
> +	if (!epc_features)
> +		return -EINVAL;
>  	barno = ntb->epf_ntb_bar[BAR_DB];
>  	epf_bar = &ntb->epf->bar[barno];
>  
> @@ -852,6 +858,8 @@ static int epf_ntb_init_epc_bar(struct epf_ntb *ntb)
>  	num_mws = ntb->num_mws;
>  	dev = &ntb->epf->dev;
>  	epc_features = pci_epc_get_features(ntb->epf->epc, ntb->epf->func_no, ntb->epf->vfunc_no);
> +	if (!epc_features)
> +		return -EINVAL;
>  
>  	/* These are required BARs which are mandatory for NTB functionality */
>  	for (bar = BAR_CONFIG; bar <= BAR_MW1; bar++) {
> -- 
> 2.50.1
>