Re: [PATCH v4 3/4] drm/xe/vf: Add bounds checking for queried context and doorbell counts

On 7/28/2026 11:50 AM, Satyanarayana K V P wrote:
> Add explicit bounds checks for context and doorbells which can detect
> and reject invalid configuration data from a misconfigured or
> malfunctioning PF, preventing protocol violations and protecting VF
> initialization.
> 
> Signed-off-by: Satyanarayana K V P <[email protected]>
> Cc: Michal Wajdeczko <[email protected]>
> ---
> V3 -> V4:
>  - New commit
> ---
>  drivers/gpu/drm/xe/xe_gt_sriov_vf.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_gt_sriov_vf.c b/drivers/gpu/drm/xe/xe_gt_sriov_vf.c
> index e96515766081..69e531be15ed 100644
> --- a/drivers/gpu/drm/xe/xe_gt_sriov_vf.c
> +++ b/drivers/gpu/drm/xe/xe_gt_sriov_vf.c
> @@ -15,6 +15,7 @@
>  #include "abi/guc_klvs_abi.h"
>  #include "abi/guc_relay_actions_abi.h"
>  #include "regs/xe_gt_regs.h"
> +#include "regs/xe_guc_regs.h"
>  
>  #include "xe_assert.h"
>  #include "xe_device.h"
> @@ -581,7 +582,10 @@ static int vf_get_ctxs_cfg(struct xe_gt *gt)
>  	if (unlikely(err))
>  		return err;
>  
> -	if (config->num_ctxs && config->num_ctxs != num_ctxs) {
> +	if (num_ctxs > GUC_ID_MAX) {
> +		xe_gt_sriov_err(gt, "Out of bound CTXs %u received\n", num_ctxs);
> +		return -EPROTO;
> +	} else if (config->num_ctxs && config->num_ctxs != num_ctxs) {

no need for "else" as there is a 'return' in previous 'if' block

>  		xe_gt_sriov_err(gt, "Unexpected CTXs reassignment: %u != %u\n",
>  				num_ctxs, config->num_ctxs);
>  		return -EREMCHG;
> @@ -607,7 +611,10 @@ static int vf_get_dbs_cfg(struct xe_gt *gt)
>  	if (unlikely(err))
>  		return err;
>  
> -	if (config->num_dbs && config->num_dbs != num_dbs) {
> +	if (num_dbs > GUC_NUM_DOORBELLS) {
> +		xe_gt_sriov_err(gt, "Out of bound DBs %u received\n", num_dbs);
> +		return -EPROTO;
> +	} else if (config->num_dbs && config->num_dbs != num_dbs) {

ditto

>  		xe_gt_sriov_err(gt, "Unexpected DBs reassignment: %u != %u\n",
>  				num_dbs, config->num_dbs);
>  		return -EREMCHG;