[PATCH v2 0/2] misc: pci_endpoint_test: doorbell BAR validation fixes

[PATCH v2 0/2] misc: pci_endpoint_test: doorbell BAR validation fixes

[Carlos Bilbao (Lambda)]

From: Carlos Bilbao <carlos.bilbao@kernel.org>

pci_endpoint_test_doorbell() reads a BAR number from endpoint MMIO and
uses it as an array index into test->bar[].  Add a defensive bounds check
covering both out-of-range positive values and NO_BAR (-1), and remove a
dead register read that precedes the writel sequence.

Changes since v1:

- Patch 1: extend bounds check to also reject NO_BAR (-1), which is the
  Use %d (not %u) in the error message.
- Patch 2: no code change; add Reviewed-by tag.

Carlos Bilbao (2):
  misc: pci_endpoint_test: validate BAR index in doorbell test
  misc: pci_endpoint_test: remove dead BAR read before doorbell trigger

 drivers/misc/pci_endpoint_test.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

-- 
2.43.0

[PATCH v2 1/2] misc: pci_endpoint_test: validate BAR index in doorbell test

[Carlos Bilbao (Lambda)]

From: Carlos Bilbao <carlos.bilbao@kernel.org>

pci_endpoint_test_doorbell() reads the BAR number directly from an endpoint
test register and uses it as an index into test->bar[].  Add a defensive
bounds check before the dereference: positive values >= PCI_STD_NUM_BARS
are out of range, and NO_BAR (-1) as a negative signed value would slip
past an upper-bound-only check.

Signed-off-by: Carlos Bilbao (Lambda) <carlos.bilbao@kernel.org>
---
 drivers/misc/pci_endpoint_test.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
index 74ab5b5b9011..0d0b430de0e8 100644
--- a/drivers/misc/pci_endpoint_test.c
+++ b/drivers/misc/pci_endpoint_test.c
@@ -1089,6 +1089,11 @@ static int pci_endpoint_test_doorbell(struct pci_endpoint_test *test)
 	pci_endpoint_test_writel(test, PCI_ENDPOINT_TEST_STATUS, 0);
 
 	bar = pci_endpoint_test_readl(test, PCI_ENDPOINT_TEST_DB_BAR);
+	if (bar < BAR_0 || bar >= PCI_STD_NUM_BARS) {
+		dev_err(dev, "BAR %d reported by endpoint out of range [0, %u]\n",
+			bar, PCI_STD_NUM_BARS - 1);
+		return -EINVAL;
+	}
 
 	writel(data, test->bar[bar] + addr);
 
-- 
2.43.0

[PATCH v2 2/2] misc: pci_endpoint_test: remove dead BAR read before doorbell trigger

[Carlos Bilbao (Lambda)]

From: Carlos Bilbao <carlos.bilbao@kernel.org>

The assignment before the writel sequence is dead code (bar is
unconditionally overwritten by the re-read immediately after) so remove the
call entirely.

Note that the DB_BAR register is a plain value written by the endpoint
firmware; reading it carries no side effect.

Signed-off-by: Carlos Bilbao (Lambda) <carlos.bilbao@kernel.org>
Reviewed-by: Koichiro Den <den@valinux.co.jp>
---
 drivers/misc/pci_endpoint_test.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
index 0d0b430de0e8..7affab786ae4 100644
--- a/drivers/misc/pci_endpoint_test.c
+++ b/drivers/misc/pci_endpoint_test.c
@@ -1081,7 +1081,6 @@ static int pci_endpoint_test_doorbell(struct pci_endpoint_test *test)
 
 	data = pci_endpoint_test_readl(test, PCI_ENDPOINT_TEST_DB_DATA);
 	addr = pci_endpoint_test_readl(test, PCI_ENDPOINT_TEST_DB_OFFSET);
-	bar = pci_endpoint_test_readl(test, PCI_ENDPOINT_TEST_DB_BAR);
 
 	pci_endpoint_test_writel(test, PCI_ENDPOINT_TEST_IRQ_TYPE, irq_type);
 	pci_endpoint_test_writel(test, PCI_ENDPOINT_TEST_IRQ_NUMBER, 1);
-- 
2.43.0

Re: [PATCH v2 0/2] misc: pci_endpoint_test: doorbell BAR validation fixes

[Manivannan Sadhasivam]

On Fri, 10 Apr 2026 16:02:58 -0700, Carlos Bilbao (Lambda) wrote:
> From: Carlos Bilbao <carlos.bilbao@kernel.org>
> 
> pci_endpoint_test_doorbell() reads a BAR number from endpoint MMIO and
> uses it as an array index into test->bar[].  Add a defensive bounds check
> covering both out-of-range positive values and NO_BAR (-1), and remove a
> dead register read that precedes the writel sequence.
> 
> [...]

Applied, thanks!

[1/2] misc: pci_endpoint_test: validate BAR index in doorbell test
      commit: 36b80ae4206ac382fa298286277c70be1d6989fe
[2/2] misc: pci_endpoint_test: remove dead BAR read before doorbell trigger
      commit: 89b3c5044867c86e421a121481b1ca8cd00a3f6e

Best regards,
-- 
Manivannan Sadhasivam <mani@kernel.org>