PCI: Avoid access memory outside the resource window
PATCH 1/2 PCI: Avoid access memory outside the resource window
change ">" to ">=" to avoid access beyond the actual length of io memory.
--- drivers/pci/rom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/rom.c +1 -1
@@ -108,7 +108,7 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size) length =readw (pds +16 ); image += length *512 ;/* Avoid iterating through memory outside the resource window */ -if (image > rom + size) +if (image >= rom + size)break ; }while (length && !last_image);
Signature · 1 line
1.9.1
PATCH 2/2 PCI: Add check code for last image indicator not set
if last image indicator was not set in the PCI data struct, print out "No more image in the PCI ROM" instand of loop back and print "Invalid PCI ROM header signature" info.
--- drivers/pci/rom.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/pci/rom.c +6 -0
@@ -110,6 +110,12 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)/* Avoid iterating through memory outside the resource window */ if (image >= rom + size)break ; +if (!last_image) { +if (readw (image) !=0xAA55 ) { +pci_info (pdev,"No more image in the PCI ROM\n" ); +break ; + } + } }while (length && !last_image);/* never return a size larger than the PCI resource window */
Signature · 1 line
1.9.1
Quoted 11 lines
-----Original Message-----
From: Rex Zhu [mailto:[email protected]]
Sent: Monday, June 4, 2018 9:47 PM
To: [email protected]; Daenzer, Michel <[email protected]>; Deucher, Alexander <[email protected]>; linux- [email protected]
Cc: Zhu, Rex <[email protected]>
Subject: [PATCH 1/2] PCI: Avoid access memory outside the resource window
=20
change ">" to ">=3D" to avoid access beyond the actual length of io memor=
y.
Quoted 2 lines
=20
Signed-off-by Rex Zhu <[email protected]>
Series is:
Quoted 21 lines
--- drivers/pci/rom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)=20
drivers/pci/rom.c index 374a334..a5c6016 renamed from drivers/pci/rom.c +0
-0100644
drivers/pci/rom.c +0
-0@@ -108,7 +108,7 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size) length =3D readw(pds + 16); image +=3D length * 512;/* Avoid iterating through memory outside the resource window */
drivers/pci/rom.c +1
-1-if (image > rom + size) + if (image >=3D rom + size)break ; }while (length && !last_image);=20
--
1.9.1
Quoted 4 lines · Rex Zhu
change ">" to ">=" to avoid access beyond the actual length of io memory.
Signed-off-by Rex Zhu <[email protected]>
Both applied with Alex's reviewed-by to pci/resource for v4.19, thanks!
I also added a patch to make pci_get_rom_size() static, since it's only used by pci_map_rom().
Quoted 20 lines
--- drivers/pci/rom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)drivers/pci/rom.c +1
-1@@ -108,7 +108,7 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size) length =readw (pds +16 ); image += length *512 ;/* Avoid iterating through memory outside the resource window */ -if (image > rom + size) +if (image >= rom + size)break ; }while (length && !last_image);Signature · 1 line
1.9.1