Re: [PATCH v5 4/9] vfio/pci: Add a helper to create a DMABUF for a BAR-map VMA

Dear Sashiko,

I guess I should reply to the robot and point out false
positives/misconceptions for posterity:

On 15/07/2026 19:12, [email protected] wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] Missing bounds check on `res_index` before calling `pcim_p2pdma_provider()` leads to out-of-bounds array access.
> --
> 
> --- Patch [4]: [PATCH v5 4/9] vfio/pci: Add a helper to create a DMABUF for a BAR-map VMA ---
> commit 733300e7a6e7bd6d5e79581e31e2eac09e4e5c22
> Author: Matt Evans <[email protected]>
> 
> vfio/pci: Add a helper to create a DMABUF for a BAR-map VMA
> 
> This commit adds a helper function, vfio_pci_core_mmap_prep_dmabuf(), to
> create a single-range DMABUF for mapping a PCI BAR. It also refactors the
> existing vfio_pci_core_feature_dma_buf() to extract common export logic.
> 
>> diff --git a/drivers/vfio/pci/vfio_pci_dmabuf.c b/drivers/vfio/pci/vfio_pci_dmabuf.c
>> index 7c047400dfd16..74c02794bfe28 100644
>> --- a/drivers/vfio/pci/vfio_pci_dmabuf.c
>> +++ b/drivers/vfio/pci/vfio_pci_dmabuf.c
> 
> [ ... ]
> 
>> @@ -460,6 +473,75 @@ int vfio_pci_core_feature_dma_buf(struct vfio_pci_core_device *vdev, u32 flags,
>>  	return ret;
>>  }
>>  
>> +int vfio_pci_core_mmap_prep_dmabuf(struct vfio_pci_core_device *vdev,
>> +				   struct vm_area_struct *vma,
>> +				   u64 phys_start, u64 req_len,
>> +				   unsigned int res_index)
>> +{
>> +	struct vfio_pci_dma_buf *priv;
> 
> [ ... ]
> 
>> +	priv->vdev = vdev;
>> +	priv->size = req_len;
>> +	priv->nr_ranges = 1;
>> +	priv->vma_pgoff_adjust = vma_pgoff;
>> +	priv->provider = pcim_p2pdma_provider(vdev->pdev, res_index);
> 
> [Severity: Medium]
> Is a bounds check needed on res_index before calling pcim_p2pdma_provider()?

No.

> If a caller passes an index like VFIO_PCI_ROM_REGION_INDEX (6) or higher, 
> pcim_p2pdma_provider() will index the mem[PCI_STD_NUM_BARS] array out of
> bounds, returning an invalid pointer. 
> 
> This invalid pointer could later be dereferenced by pci_p2pdma_map_type() 
> in dma_buf_phys_vec_to_sgt(), which might lead to memory corruption or crashes.

The index is checked by the (only) caller, vfio_pci_core_mmap(), at the
point of first consumption from userspace and cannot be out of range here.

Defensively, this mid-level function _could_ check, but then the
argument could also be made that pcim_p2pdma_provider() should
bounds-check its parameters before pci_resource_flags(dev, index) too;
evidently we've chosen for callers to ensure things are in range instead
and I'd say that applies to this function too.


Matt