Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] Missing bounds check on `res_index` before calling `pcim_p2pdma_provider()` leads to out-of-bounds array access. --
--- Patch [4]: [PATCH v5 4/9] vfio/pci: Add a helper to create a DMABUF for a BAR-map VMA --- commit 733300e7a6e7bd6d5e79581e31e2eac09e4e5c22 Author: Matt Evans <[email protected]> vfio/pci: Add a helper to create a DMABUF for a BAR-map VMA This commit adds a helper function, vfio_pci_core_mmap_prep_dmabuf(), to create a single-range DMABUF for mapping a PCI BAR. It also refactors the existing vfio_pci_core_feature_dma_buf() to extract common export logic. > diff --git a/drivers/vfio/pci/vfio_pci_dmabuf.c > b/drivers/vfio/pci/vfio_pci_dmabuf.c > index 7c047400dfd16..74c02794bfe28 100644 > --- a/drivers/vfio/pci/vfio_pci_dmabuf.c > +++ b/drivers/vfio/pci/vfio_pci_dmabuf.c [ ... ] > @@ -460,6 +473,75 @@ int vfio_pci_core_feature_dma_buf(struct > vfio_pci_core_device *vdev, u32 flags, > return ret; > } > > +int vfio_pci_core_mmap_prep_dmabuf(struct vfio_pci_core_device *vdev, > + struct vm_area_struct *vma, > + u64 phys_start, u64 req_len, > + unsigned int res_index) > +{ > + struct vfio_pci_dma_buf *priv; [ ... ] > + priv->vdev = vdev; > + priv->size = req_len; > + priv->nr_ranges = 1; > + priv->vma_pgoff_adjust = vma_pgoff; > + priv->provider = pcim_p2pdma_provider(vdev->pdev, res_index); [Severity: Medium] Is a bounds check needed on res_index before calling pcim_p2pdma_provider()? If a caller passes an index like VFIO_PCI_ROM_REGION_INDEX (6) or higher, pcim_p2pdma_provider() will index the mem[PCI_STD_NUM_BARS] array out of bounds, returning an invalid pointer. This invalid pointer could later be dereferenced by pci_p2pdma_map_type() in dma_buf_phys_vec_to_sgt(), which might lead to memory corruption or crashes. > + if (!priv->provider) { > + ret = -EINVAL; > + goto err_free_phys; > + } > + > + priv->phys_vec[0].paddr = phys_start + ((u64)vma_pgoff << PAGE_SHIFT); > + priv->phys_vec[0].len = priv->size; [ ... ] -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=4
