Changeset 21ff054 in mainline

Timestamp:

2018-05-22T19:06:50Z (6 years ago)

Author:

Jakub Jermar <jakub@…>

Branches:

lfn, master, serial, ticket/834-toolchain-update, topic/msim-upgrade, topic/simplify-dev-export

Children:

5f03107

Parents:

4e2d387

git-author:

Jakub Jermar <jakub@…> (2018-04-25 19:17:47)

git-committer:

Jakub Jermar <jakub@…> (2018-05-22 19:06:50)

Message:

Make sure the PCI capability is big enough

Location:

uspace/lib/virtio

Files:

• virtio-pci.c (modified) (2 diffs)
• virtio-pci.h (modified) (1 diff)

uspace/lib/virtio/virtio-pci.c

@@ -180 +180 @@
          */
         uint8_t c;
-        uint8_t id;
-        for (rc = pci_config_space_cap_first(pci_sess, &c, &id);
+        uint8_t cap_vndr;
+        for (rc = pci_config_space_cap_first(pci_sess, &c, &cap_vndr);
             (rc == EOK) && c;
-            rc = pci_config_space_cap_next(pci_sess, &c, &id)) {
-                if (id != PCI_CAP_VENDORSPECID)
+            rc = pci_config_space_cap_next(pci_sess, &c, &cap_vndr)) {
+                if (cap_vndr != PCI_CAP_VENDORSPECID)
                         continue;
 
-                uint8_t type;
-                rc = pci_config_space_read_8(pci_sess, VIRTIO_PCI_CAP_TYPE(c),
-                    &type);
+                uint8_t cap_len;
+                rc = pci_config_space_read_8(pci_sess,
+                    VIRTIO_PCI_CAP_CAP_LEN(c), &cap_len);
+                if (rc != EOK)
+                        goto error;
+
+                if (cap_len < VIRTIO_PCI_CAP_END(0)) {
+                        rc = EINVAL;
+                        goto error;
+                }
+
+                uint8_t cfg_type;
+                rc = pci_config_space_read_8(pci_sess,
+                    VIRTIO_PCI_CAP_CFG_TYPE(c), &cfg_type);
                 if (rc != EOK)
                         goto error;
@@ -212 +223 @@
 
                 uint32_t multiplier;
-                switch (type) {
+                switch (cfg_type) {
                 case VIRTIO_PCI_CAP_COMMON_CFG:
                         virtio_pci_common_cfg(vdev, bar, offset, length);
                         break;
                 case VIRTIO_PCI_CAP_NOTIFY_CFG:
+                        if (cap_len < VIRTIO_PCI_CAP_END(sizeof(uint32_t))) {
+                                rc = EINVAL;
+                                goto error;
+                        }
                         rc = pci_config_space_read_32(pci_sess,
                             VIRTIO_PCI_CAP_END(c), &multiplier);

uspace/lib/virtio/virtio-pci.h

@@ -37 +37 @@
 #include <ddi.h>
 
-#define VIRTIO_PCI_CAP_TYPE(c)          ((c) + 3)
+#define VIRTIO_PCI_CAP_CAP_LEN(c)       ((c) + 2)
+#define VIRTIO_PCI_CAP_CFG_TYPE(c)      ((c) + 3)
 #define VIRTIO_PCI_CAP_BAR(c)           ((c) + 4)
 #define VIRTIO_PCI_CAP_OFFSET(c)        ((c) + 8)