[PATCH 01/13] PCI/P2PDMA: Safely terminate ACS redirect lists
From: Leon Romanovsky <leon@kernel.org>
Date: 2026-08-02 15:10:08
Also in:
linux-pci, lkml
Subsystem:
pci peer-to-peer dma (p2pdma), pci subsystem, the rest · Maintainers:
Bjorn Helgaas, Logan Gunthorpe, Linus Torvalds
From: Leon Romanovsky <leonro@nvidia.com>
seq_buf marks an overflow by setting len to size + 1. The ACS diagnostic
path unconditionally writes a terminator to buffer[len - 1], so a path
with enough ACS ports to fill the 128-byte buffer writes one byte beyond
the buffer when verbose diagnostics are requested.
Use seq_buf_str() to terminate truncated output safely and remove the final
semicolon only when the buffer did not overflow.
Fixes: 52916982af48 ("PCI/P2PDMA: Support peer-to-peer memory")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
drivers/pci/p2pdma.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c
index b2d5266f8653..2d3b380cc578 100644
--- a/drivers/pci/p2pdma.c
+++ b/drivers/pci/p2pdma.c@@ -766,11 +766,13 @@ calc_map_type_and_dist(struct pci_dev *provider, struct pci_dev *client, } if (verbose) { - acs_list.buffer[acs_list.len-1] = 0; /* drop final semicolon */ + /* Drop the final semicolon; the list is not empty here. */ + if (!seq_buf_has_overflowed(&acs_list)) + acs_list.buffer[acs_list.len - 1] = '\0'; pci_warn(client, "ACS redirect is set between the client and provider (%s)\n", pci_name(provider)); pci_warn(client, "to disable ACS redirect for this path, add the kernel parameter: pci=disable_acs_redir=%s\n", - acs_list.buffer); + seq_buf_str(&acs_list)); } acs_redirects = true;
--
2.55.0