PCI: Fail MSI-X mapping if MSI-X Table offset is out of range of BAR space

euler inclusion
category: bugfix
bugzilla: 4390
CVE: NA

----------------------------------------

This patch add check for the offset of MSI-X Table. If it is out of range
of the BAR space BIR selects, we just fail this MSI-X mapping.
Signed-off-by: NXiongfeng Wang <xiongfeng.wang@linaro.org>
Reviewed-by: NHanjun Guo <guohanjun@huawei.com>
Signed-off-by: NMao Wenan <maowenan@huawei.com>
Signed-off-by: NHui Wang <john.wanghui@huawei.com>
Signed-off-by: NZhang Xiaoxu <zhangxiaoxu5@huawei.com>
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
Reviewed-by: NXiongfeng Wang <wangxiongfeng2@huawei.com>
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>

drivers/pci/msi.c

@@ -663,6 +663,12 @@ static void __iomem *msix_map_region(struct pci_dev *dev, unsigned nr_entries)
 		return NULL;
 
 	table_offset &= PCI_MSIX_TABLE_OFFSET;
+	if (table_offset >= pci_resource_len(dev, bir)) {
+		dev_err(&dev->dev,
+			"MSI-X Table offset is out of range of BAR:%d!\n",
+			bir);
+		return NULL;
+	}
 	phys_addr = pci_resource_start(dev, bir) + table_offset;
 
 	return ioremap_nocache(phys_addr, nr_entries * PCI_MSIX_ENTRY_SIZE);