linux-kernel - [PATCH 0/3] PCI: endpoint: Clarify pci_epc_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260131133655.218018-1-den@valinux.co.jp>
Date: Sat, 31 Jan 2026 22:36:52 +0900
From: Koichiro Den <den@...inux.co.jp>
To: mani@...nel.org,
	cassel@...nel.org,
	kwilczynski@...nel.org,
	kishon@...nel.org,
	bhelgaas@...gle.com,
	corbet@....net,
	jingoohan1@...il.com,
	lpieralisi@...nel.org,
	robh@...nel.org,
	Frank.Li@....com
Cc: linux-pci@...r.kernel.org,
	linux-doc@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH 0/3] PCI: endpoint: Clarify pci_epc_set_bar() lifetime rules

Hi,

This patch series is a follow-up to a side discussion that started from
Niklas' comment at:
https://lore.kernel.org/all/aXtrW7viGZfMNZur@ryzen/

That discussion highlighted implicit ownership/lifetime assumptions in
the pci_epc_set_bar() interface: some EPC drivers keep a reference to
the struct pci_epf_bar passed in (and its optional submap array).
Mutating or freeing those objects after a successful pci_epc_set_bar()
can lead to use-after-free or other undefined or hard-to-debug behavior.

This series:
  1) Makes BAR Match vs Address Match teardown in DesignWare EP explicit
     by returning right after clearing a BAR-match inbound mapping.
  2) Fixes pci-epf-test BAR subrange mapping to use a dedicated
     pci_epf_bar instance and to free the allocated submap only after
     restoring the default BAR mapping.
  3) Documents pci_epc_set_bar() caller ownership and lifetime rules.

Base: controller/dwc branch, latest:
commit a24149881558 ("PCI: dwc: ep: Add comment explaining controller level
                      PTM access in multi PF setup")

Thanks,

Koichiro Den (3):
  PCI: dwc: ep: Return after clearing BAR-match inbound mapping
  PCI: endpoint: pci-epf-test: Use dedicated pci_epf_bar for subrange
    mapping
  PCI: endpoint: Document pci_epc_set_bar() caller ownership and
    lifetime rules

 Documentation/PCI/endpoint/pci-endpoint.rst   | 22 +++++++++++++
 .../pci/controller/dwc/pcie-designware-ep.c   |  1 +
 drivers/pci/endpoint/functions/pci-epf-test.c | 32 ++++++-------------
 3 files changed, 33 insertions(+), 22 deletions(-)

-- 
2.51.0