From 068dee79586a772c44dc4dcd7e8ba1f5d395b46c Mon Sep 17 00:00:00 2001 From: Xiongfeng Wang Date: Sat, 16 Feb 2019 20:32:24 +0800 Subject: [PATCH] PCI: Fail MSI-X mapping if MSI-X Table offset is out of range of BAR space euler inclusion category: bugfix bugzilla: 4390 CVE: NA ---------------------------------------- This patch add check for the offset of MSI-X Table. If it is out of range of the BAR space BIR selects, we just fail this MSI-X mapping. Signed-off-by: Xiongfeng Wang Reviewed-by: Hanjun Guo Signed-off-by: Mao Wenan Signed-off-by: Hui Wang Signed-off-by: Zhang Xiaoxu Signed-off-by: Yang Yingliang Reviewed-by: Xiongfeng Wang Signed-off-by: Yang Yingliang --- drivers/pci/msi.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c index af24ed50a245..007f0110a628 100644 --- a/drivers/pci/msi.c +++ b/drivers/pci/msi.c @@ -663,6 +663,12 @@ static void __iomem *msix_map_region(struct pci_dev *dev, unsigned nr_entries) return NULL; table_offset &= PCI_MSIX_TABLE_OFFSET; + if (table_offset >= pci_resource_len(dev, bir)) { + dev_err(&dev->dev, + "MSI-X Table offset is out of range of BAR:%d!\n", + bir); + return NULL; + } phys_addr = pci_resource_start(dev, bir) + table_offset; return ioremap_nocache(phys_addr, nr_entries * PCI_MSIX_ENTRY_SIZE); -- GitLab