[PATCH 1/2] PCI: Avoid access memory outside the resource window

[PATCH 1/2] PCI: Avoid access memory outside the resource window

[Rex Zhu]

change ">" to ">=" to avoid access beyond the actual
length of io memory.

Signed-off-by: Rex Zhu <Rex.Zhu@amd.com>
---
 drivers/pci/rom.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
index 374a334..a5c6016 100644
--- a/drivers/pci/rom.c
+++ b/drivers/pci/rom.c
@@ -108,7 +108,7 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
 		length = readw(pds + 16);
 		image += length * 512;
 		/* Avoid iterating through memory outside the resource window */
-		if (image > rom + size)
+		if (image >= rom + size)
 			break;
 	} while (length && !last_image);
 
-- 
1.9.1

[PATCH 2/2] PCI: Add check code for last image indicator not set

[Rex Zhu]

if last image indicator was not set in the PCI data struct,
print out "No more image in the PCI ROM" instand of
loop back and print "Invalid PCI ROM header signature" info.

Signed-off-by: Rex Zhu <Rex.Zhu@amd.com>
---
 drivers/pci/rom.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
index a5c6016..a8b916b 100644
--- a/drivers/pci/rom.c
+++ b/drivers/pci/rom.c
@@ -110,6 +110,12 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
 		/* Avoid iterating through memory outside the resource window */
 		if (image >= rom + size)
 			break;
+		if (!last_image) {
+			if (readw(image) != 0xAA55) {
+				pci_info(pdev, "No more image in the PCI ROM\n");
+				break;
+			}
+		}
 	} while (length && !last_image);
 
 	/* never return a size larger than the PCI resource window */
-- 
1.9.1

RE: [PATCH 1/2] PCI: Avoid access memory outside the resource window

[Deucher, Alexander]

> -----Original Message-----
> From: Rex Zhu [mailto:Rex.Zhu@amd.com]
> Sent: Monday, June 4, 2018 9:47 PM
> To: bhelgaas@google.com; Daenzer, Michel <Michel.Daenzer@amd.com>;
> Deucher, Alexander <Alexander.Deucher@amd.com>; linux-
> pci@vger.kernel.org
> Cc: Zhu, Rex <Rex.Zhu@amd.com>
> Subject: [PATCH 1/2] PCI: Avoid access memory outside the resource
> window
>=20
> change ">" to ">=3D" to avoid access beyond the actual length of io memor=
y.
>=20
> Signed-off-by: Rex Zhu <Rex.Zhu@amd.com>

Series is:
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>

> ---
>  drivers/pci/rom.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>=20
> diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c index 374a334..a5c6016
> 100644
> --- a/drivers/pci/rom.c
> +++ b/drivers/pci/rom.c
> @@ -108,7 +108,7 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void
> __iomem *rom, size_t size)
>  		length =3D readw(pds + 16);
>  		image +=3D length * 512;
>  		/* Avoid iterating through memory outside the resource
> window */
> -		if (image > rom + size)
> +		if (image >=3D rom + size)
>  			break;
>  	} while (length && !last_image);
>=20
> --
> 1.9.1

Re: [PATCH 1/2] PCI: Avoid access memory outside the resource window

[Bjorn Helgaas]

On Tue, Jun 05, 2018 at 09:46:45AM +0800, Rex Zhu wrote:
> change ">" to ">=" to avoid access beyond the actual
> length of io memory.
> 
> Signed-off-by: Rex Zhu <Rex.Zhu@amd.com>

Both applied with Alex's reviewed-by to pci/resource for v4.19, thanks!

I also added a patch to make pci_get_rom_size() static, since it's only
used by pci_map_rom().

> ---
>  drivers/pci/rom.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
> index 374a334..a5c6016 100644
> --- a/drivers/pci/rom.c
> +++ b/drivers/pci/rom.c
> @@ -108,7 +108,7 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
>  		length = readw(pds + 16);
>  		image += length * 512;
>  		/* Avoid iterating through memory outside the resource window */
> -		if (image > rom + size)
> +		if (image >= rom + size)
>  			break;
>  	} while (length && !last_image);
>  
> -- 
> 1.9.1
>