Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-09-20 23:13:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

x86/PCI: Add PIRQ routing table range checks

Browse Source 
Verify that the PCI IRQ Routing Table header as well as individual slot 
entries are all wholly contained within the BIOS memory area.  Do not 
even call the checksum calculator if the header would overrun the area 
and then bail out early if any slot would.

Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/alpine.DEB.2.21.2203301735510.22465@angie.orcam.me.uk
This commit is contained in:
Maciej W. Rozycki 2022-03-31 08:10:55 +01:00 committed by Thomas Gleixner
parent fe62bc2362
commit 5d64089aa4
1 changed files with 12 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
arch/x86/pci/irq.c
View File

@ -68,7 +68,8 @@ void (*pcibios_disable_irq)(struct pci_dev *dev) = pirq_disable_irq;
* and perform checksum verification.
*/
static inline struct irq_routing_table *pirq_check_routing_table(u8 *addr)
static inline struct irq_routing_table *pirq_check_routing_table(u8 *addr,
u8 *limit)
{
struct irq_routing_table *rt;
int i;
@ -78,7 +79,8 @@ static inline struct irq_routing_table *pirq_check_routing_table(u8 *addr)
if (rt->signature != PIRQ_SIGNATURE ||
rt->version != PIRQ_VERSION ||
rt->size % 16 ||
rt->size < sizeof(struct irq_routing_table))
rt->size < sizeof(struct irq_routing_table) ||
(limit && rt->size > limit - addr))
return NULL;
sum = 0;
for (i = 0; i < rt->size; i++)
@ -99,17 +101,22 @@ static inline struct irq_routing_table *pirq_check_routing_table(u8 *addr)
static struct irq_routing_table * __init pirq_find_routing_table(void)
{
u8 * const bios_start = (u8 *)__va(0xf0000);
u8 * const bios_end = (u8 *)__va(0x100000);
u8 *addr;
struct irq_routing_table *rt;
if (pirq_table_addr) {
rt = pirq_check_routing_table((u8 *) __va(pirq_table_addr));
rt = pirq_check_routing_table((u8 *)__va(pirq_table_addr),
NULL);
if (rt)
return rt;
printk(KERN_WARNING "PCI: PIRQ table NOT found at pirqaddr\n");
}
for (addr = (u8 *) __va(0xf0000); addr < (u8 *) __va(0x100000); addr += 16) {
rt = pirq_check_routing_table(addr);
for (addr = bios_start;
addr < bios_end - sizeof(struct irq_routing_table);
addr += 16) {
rt = pirq_check_routing_table(addr, bios_end);
if (rt)
return rt;
}