From 53482bca25b59c09beadb3db16bba7f1bf8bd67d Mon Sep 17 00:00:00 2001
From: Xiongfeng Wang <wangxiongfeng2@huawei.com>
Date: Tue, 9 Jul 2019 16:43:11 +0800
Subject: [PATCH] PCI: check BIR before mapping MSI-X Table
hulk inclusion
category: bugfix
bugzilla: 4390
CVE: NA
-------------------
We use 'bir' as the index of array resource[DEVICE_COUNT_RESOURCE].
Wrong 'bir' will cause access out of range. This patch add a check for
'bir'.
Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei.com>
Reviewed-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
---
drivers/pci/msi.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 007f0110a628..ac41db3c5dd1 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -658,6 +658,11 @@ static void __iomem *msix_map_region(struct pci_dev *dev, unsigned nr_entries)
pci_read_config_dword(dev, dev->msix_cap + PCI_MSIX_TABLE,
&table_offset);
bir = (u8)(table_offset & PCI_MSIX_TABLE_BIR);
+ if (bir >= DEVICE_COUNT_RESOURCE) {
+ dev_err(&dev->dev, "MSI-X Table BIR is out of range !\n");
+ return NULL;
+ }
+
flags = pci_resource_flags(dev, bir);
if (!flags || (flags & IORESOURCE_UNSET))
return NULL;
--
GitLab