From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 42F33C433EF for ; Sun, 20 Mar 2022 11:45:07 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 0E10B83B39; Sun, 20 Mar 2022 12:43:50 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.b="i2Xtzkw7"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 1ECE4838F0; Sun, 20 Mar 2022 12:42:12 +0100 (CET) Received: from mail-wm1-x34a.google.com (mail-wm1-x34a.google.com [IPv6:2a00:1450:4864:20::34a]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 5302D83ADC for ; Sun, 20 Mar 2022 12:42:09 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=3EBM3YgYKBisHZJbSSNVVNSL.JVTb-IVVaSPZaZ.KLUe.KL@flex--ascull.bounces.google.com Received: by mail-wm1-x34a.google.com with SMTP id v184-20020a1cacc1000000b0038a12dbc23bso8682443wme.5 for ; Sun, 20 Mar 2022 04:42:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=rc1yA9DHWB4u0CI7LEwwjN2KD+t+PcCvtFrOJP3pB30=; b=i2Xtzkw7wapXGjYi+k9qbTeGMHl8Yr5eY+OQgx2MtHdYcJEKiFAjrMx9mOyFLiLFeP ng1iMxZqzZlJjhzG7HBHFLJRKEF9rzsnuzlz8eaPa3PXLh2cgiT36rjnpt8Y+aNYqwvY ywP5+hNh7n6ZTfM8+ukPG+m0UAs1OtxvVFaplNOoscctJCcsdvXgBvdW3lK9+FDP2jcA joONc//amstP/mMZf5D6SNE+TN1cUPfZBF/9Qk9NsoAnSde0TpEnHruwQmUtgXs2Ou6O BL/JTsumfrVA1Qd4udTkdtvEHEI3aFObOW+alyZ9flVmLSeLWj2JoH8EggnmnS90r5ja 1y0A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=rc1yA9DHWB4u0CI7LEwwjN2KD+t+PcCvtFrOJP3pB30=; b=HJvC9hreAn4TLFM0i/4YftRQCuRw5vfl/cfHQ5z24x3yD70uHs80Fr4JDKuMt3N/FC eUGws7Fue6UZQ15DF41IeMak/OAjaloOokZis75R+BxLtfgB2NPZZpkOpOssrcRt0Qbi PxJyVrBiCPdwzXPVjR7gatoPAz6NIZHIAcVxr2Ns9arx9Q81ubUIxSHOtUq94RfvkHvI ClvMGJS2ZGHlAubTNBgXoEdj+aDXi8c0z9q96o1gW9njZFpDUvTfehOkijatSR3CYR4v DU76F3UD0qxwTd9o8BOqPsUVvrVKFdqIr+ATDt/VKQcvIfWd3B/c64PALGpZaDxAR/I3 +zSQ== X-Gm-Message-State: AOAM532Kplu0oCx4Fu7vZGRcycc+FnHcCBoRLAlwLOg7jTBYvQMtZo5t /06/JrI8htDB6lfljLPhiPm+LtEY/P3QEk6Rc/4Ruw/I5xvpsVNMRDEbJRIKdddqcDELgPxQIxF NZ0WJ0DwBodOtndxAA/2hWWYZa5fFYEM929pTuYrJWAGovB8apdioxhp6W5M= X-Google-Smtp-Source: ABdhPJynGm4oOHgOCkJPKDqS0uv08KHzVz4sCkRxZYboDkwbGOKBN43AAJFVmyw48ZSJtrNhhqnI3VJnxQo= X-Received: from ascull.c.googlers.com ([fda3:e722:ac3:cc00:28:9cb1:c0a8:1510]) (user=ascull job=sendgmr) by 2002:a7b:c2aa:0:b0:389:891f:1fd1 with SMTP id c10-20020a7bc2aa000000b00389891f1fd1mr23143784wmk.138.1647776528945; Sun, 20 Mar 2022 04:42:08 -0700 (PDT) Date: Sun, 20 Mar 2022 11:41:17 +0000 In-Reply-To: <20220320114118.2237795-1-ascull@google.com> Message-Id: <20220320114118.2237795-11-ascull@google.com> Mime-Version: 1.0 References: <20220320114118.2237795-1-ascull@google.com> X-Mailer: git-send-email 2.35.1.894.gb6a874cedc-goog Subject: [PATCH 10/11] virtio: pci: Check mapped range is in a PCI region From: Andrew Scull To: u-boot@lists.denx.de Cc: sjg@chromium.org, bmeng.cn@gmail.com, adelva@google.com, keirf@google.com, ptosi@google.com, Andrew Scull Content-Type: text/plain; charset="UTF-8" X-Mailman-Approved-At: Sun, 20 Mar 2022 12:43:23 +0100 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.5 at phobos.denx.de X-Virus-Status: Clean The virtio PCI capabilities describe a region of memory that should be mapped. Ensure those are valid PCI regions before accessing them. Signed-off-by: Andrew Scull --- drivers/virtio/virtio_pci_modern.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/drivers/virtio/virtio_pci_modern.c b/drivers/virtio/virtio_pci_modern.c index 2f1a1cedbc..84750e2b27 100644 --- a/drivers/virtio/virtio_pci_modern.c +++ b/drivers/virtio/virtio_pci_modern.c @@ -457,8 +457,9 @@ static int virtio_pci_find_capability(struct udevice *udev, u8 cfg_type, static void __iomem *virtio_pci_map_capability(struct udevice *udev, const struct virtio_pci_cap *cap) { - ulong base; - void __iomem *p; + unsigned long mask, flags; + phys_addr_t phys_addr; + u32 base; if (!cap) return NULL; @@ -470,9 +471,23 @@ static void __iomem *virtio_pci_map_capability(struct udevice *udev, * For simplicity, only read the BAR address as 32-bit. */ base = dm_pci_read_bar32(udev, cap->bar); - p = (void __iomem *)base + cap->offset; - return p; + if (U32_MAX - base < cap->offset) + return NULL; + base += cap->offset; + + if (U32_MAX - base < cap->length) + return NULL; + + /* Find the corresponding memory region that isn't system memory. */ + mask = PCI_REGION_TYPE | PCI_REGION_SYS_MEMORY; + flags = PCI_REGION_MEM; + phys_addr = dm_pci_bus_range_to_phys(dev_get_parent(udev), base, + cap->length, mask, flags); + if (!phys_addr) + return NULL; + + return (void __iomem *)map_physmem(phys_addr, cap->length, MAP_NOCACHE); } static int virtio_pci_bind(struct udevice *udev) -- 2.35.1.894.gb6a874cedc-goog