[PATCH] sisfb: limit POST memory test according to PCI resource length

[PATCH] sisfb: limit POST memory test according to PCI resource length

[Aaro Koskinen]

If the POST memory test fails, the driver may access illegal memory
areas. Instead of hard coding the maximum size, set it according to the
PCI resource length. DRAM sizing will later adjust video_size to the
correct value.

Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Cc: Thomas Winischhofer <thomas@winischhofer.net>
---
 drivers/video/sis/sis_main.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/video/sis/sis_main.c b/drivers/video/sis/sis_main.c
index b52f8e4..8a528aa 100644
--- a/drivers/video/sis/sis_main.c
+++ b/drivers/video/sis/sis_main.c
@@ -4514,7 +4514,7 @@ sisfb_post_sis300(struct pci_dev *pdev)
 	} else {
 #endif
 		/* Need to map max FB size for finding out about RAM size */
-		mapsize = 64 << 20;
+		mapsize = ivideo->video_size;
 		sisfb_post_map_vram(ivideo, &mapsize, 4);
 
 		if(ivideo->video_vbase) {
@@ -4680,7 +4680,7 @@ sisfb_post_xgi_ramsize(struct sis_video_info *ivideo)
 	orSISIDXREG(SISSR, 0x20, (0x80 | 0x04));
 
 	/* Need to map max FB size for finding out about RAM size */
-	mapsize = 256 << 20;
+	mapsize = ivideo->video_size;
 	sisfb_post_map_vram(ivideo, &mapsize, 32);
 
 	if(!ivideo->video_vbase) {
@@ -5936,6 +5936,7 @@ sisfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 	}
 
 	ivideo->video_base = pci_resource_start(pdev, 0);
+	ivideo->video_size = pci_resource_len(pdev, 0);
 	ivideo->mmio_base  = pci_resource_start(pdev, 1);
 	ivideo->mmio_size  = pci_resource_len(pdev, 1);
 	ivideo->SiS_Pr.RelIO = pci_resource_start(pdev, 2) + 0x30;
-- 
1.5.6.5

Re: [PATCH] sisfb: limit POST memory test according to PCI resource length

[Paul Mundt]

On Wed, Nov 10, 2010 at 12:25:04AM +0200, Aaro Koskinen wrote:
> diff --git a/drivers/video/sis/sis_main.c b/drivers/video/sis/sis_main.c
> index b52f8e4..8a528aa 100644
> --- a/drivers/video/sis/sis_main.c
> +++ b/drivers/video/sis/sis_main.c
> @@ -4514,7 +4514,7 @@ sisfb_post_sis300(struct pci_dev *pdev)
>  	} else {
>  #endif
>  		/* Need to map max FB size for finding out about RAM size */
> -		mapsize = 64 << 20;
> +		mapsize = ivideo->video_size;
>  		sisfb_post_map_vram(ivideo, &mapsize, 4);
>  
>  		if(ivideo->video_vbase) {
> @@ -4680,7 +4680,7 @@ sisfb_post_xgi_ramsize(struct sis_video_info *ivideo)
>  	orSISIDXREG(SISSR, 0x20, (0x80 | 0x04));
>  
>  	/* Need to map max FB size for finding out about RAM size */
> -	mapsize = 256 << 20;
> +	mapsize = ivideo->video_size;
>  	sisfb_post_map_vram(ivideo, &mapsize, 32);
>  
>  	if(!ivideo->video_vbase) {
> 
sisfb_post_map_vram() expects that the mapsize >= min, and falls back on
the default aperture size otherwise. If you're going to pass in a
variable size for video_size then this expectation may no longer hold
true, and you've then changed the behaviour if an invalid size succeeds
on the initial ioremap() attempt.

Simply inserting a:

	if (*mapsize < min)
		return;

sanity check prior to the ioremap() should preserve the existing
behaviour.