Skip to contentSkip to conversation

Minor change to avoid potental overflow accessing pci option roms

PATCH Superseded Zhenzhong Duan 2 participants 4 messages Aug 16, 2013 – Aug 19, 2013

v1 of 2 Superseded Latest is v2 →

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 Minor change to avoid potental overflow accessing pci option roms

When scan pci option roms space, there is possibility to access beyond OPTIONROM_PHYSICAL_END for 2K.

This patch make the code robust though there are other checks such as 0x55AA signature.

---
 tools/firmware/rombios/rombios.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)
tools/firmware/rombios/rombios.c +2 -2
index 057aced..f5ac33e 100644
@@ -10648,7 +10648,7 @@ rom_scan_increment:
   add  cx, ax
   pop  ax       ;; Restore AX
   cmp  cx, ax
-  jbe  rom_scan_loop
+  jb  rom_scan_loop
 
   xor  ax, ax   ;; Restore DS back to 0000:
   mov  ds, ax
@@ -11022,7 +11022,7 @@ post_default_ints:
   call post_init_pic
 
   mov  cx, #0xc000  ;; init vga bios
-  mov  ax, #0xc780
+  mov  ax, #0xc800
   call rom_scan
 
   call _print_bios_banner
Signature · 1 line
1.7.3
#1 lore raw
Quoted 2 lines · Zhenzhong Duan

When scan pci option roms space, there is possibility to access beyond OPTIONROM_PHYSICAL_END for 2K.

And what happens if you do that?

Quoted 3 lines

This patch make the code robust though there are other checks such as 0x55AA signature.

You seemed to have forgotten to CC the maintainers. The MAINTAINERS file in Xen top directory has a listing.

Quoted 31 lines
---
 tools/firmware/rombios/rombios.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)
tools/firmware/rombios/rombios.c +2 -2
index 057aced..f5ac33e 100644
@@ -10648,7 +10648,7 @@ rom_scan_increment:
   add  cx, ax
   pop  ax       ;; Restore AX
   cmp  cx, ax
-  jbe  rom_scan_loop
+  jb  rom_scan_loop
 
   xor  ax, ax   ;; Restore DS back to 0000:
   mov  ds, ax
@@ -11022,7 +11022,7 @@ post_default_ints:
   call post_init_pic
 
   mov  cx, #0xc000  ;; init vga bios
-  mov  ax, #0xc780
+  mov  ax, #0xc800
   call rom_scan
 
   call _print_bios_banner
Signature · 1 line
1.7.3
#2 lore raw
Quoted 4 lines · Konrad Rzeszutek Wilk
Quoted 2 lines · Zhenzhong Duan

When scan pci option roms space, there is possibility to access beyond OPTIONROM_PHYSICAL_END for 2K.

And what happens if you do that?

I guess nothing will happen.

zduan

_______________________________________________
Xen-devel mailing list
[email protected]
http://lists.xen.org/xen-devel

#3 lore raw
Quoted 7 lines · Zhenzhong Duan
Quoted 4 lines · Konrad Rzeszutek Wilk
Quoted 2 lines · Zhenzhong Duan

When scan pci option roms space, there is possibility to access beyond OPTIONROM_PHYSICAL_END for 2K.

And what happens if you do that?

I guess nothing will happen.

OK. So this is more of a 'bad bug by code inspection', which is absolutly fine. Just please include that in the commit description.

Thanks!

Quoted 2 lines

zduan

_______________________________________________
Xen-devel mailing list
[email protected]
http://lists.xen.org/xen-devel