From: Jason Wang <jasowang@redhat.com> To: Keir Fraser <keirf@google.com> Cc: "Michael S. Tsirkin" <mst@redhat.com>, virtualization <virtualization@lists.linux-foundation.org>, linux-kernel <linux-kernel@vger.kernel.org> Subject: Re: [PATCH] virtio: pci: Sanity check the bar index in find_shm_cap Date: Tue, 22 Mar 2022 11:36:23 +0800 [thread overview] Message-ID: <CACGkMEuEh+vsDok6hrp96kgGHkxbmzskFMJOouR3mo3d3VjwdQ@mail.gmail.com> (raw) In-Reply-To: <20220321154931.859511-1-keirf@google.com> On Mon, Mar 21, 2022 at 11:49 PM Keir Fraser <keirf@google.com> wrote: > > The bar index is used as an index into the device's resource list > and should be checked as within range for a standard bar. > > Signed-off-by: Keir Fraser <keirf@google.com> Patch looks good, do we need a similar check in vp_modern_map_capability()? Thanks > --- > drivers/virtio/virtio_pci_modern.c | 10 ++++++++-- > 1 file changed, 8 insertions(+), 2 deletions(-) > > diff --git a/drivers/virtio/virtio_pci_modern.c b/drivers/virtio/virtio_pci_modern.c > index 5455bc041fb6..84bace98dff5 100644 > --- a/drivers/virtio/virtio_pci_modern.c > +++ b/drivers/virtio/virtio_pci_modern.c > @@ -293,7 +293,7 @@ static int virtio_pci_find_shm_cap(struct pci_dev *dev, u8 required_id, > > for (pos = pci_find_capability(dev, PCI_CAP_ID_VNDR); pos > 0; > pos = pci_find_next_capability(dev, pos, PCI_CAP_ID_VNDR)) { > - u8 type, cap_len, id; > + u8 type, cap_len, id, res_bar; > u32 tmp32; > u64 res_offset, res_length; > > @@ -317,7 +317,12 @@ static int virtio_pci_find_shm_cap(struct pci_dev *dev, u8 required_id, > > /* Type, and ID match, looks good */ > pci_read_config_byte(dev, pos + offsetof(struct virtio_pci_cap, > - bar), bar); > + bar), &res_bar); > + if (res_bar >= PCI_STD_NUM_BARS) { > + dev_err(&dev->dev, "%s: shm cap with bad bar: %d\n", > + __func__, res_bar); > + continue; > + } > > /* Read the lower 32bit of length and offset */ > pci_read_config_dword(dev, pos + offsetof(struct virtio_pci_cap, > @@ -337,6 +342,7 @@ static int virtio_pci_find_shm_cap(struct pci_dev *dev, u8 required_id, > length_hi), &tmp32); > res_length |= ((u64)tmp32) << 32; > > + *bar = res_bar; > *offset = res_offset; > *len = res_length; > > -- > 2.35.1.894.gb6a874cedc-goog >
WARNING: multiple messages have this Message-ID (diff)
From: Jason Wang <jasowang@redhat.com> To: Keir Fraser <keirf@google.com> Cc: virtualization <virtualization@lists.linux-foundation.org>, linux-kernel <linux-kernel@vger.kernel.org>, "Michael S. Tsirkin" <mst@redhat.com> Subject: Re: [PATCH] virtio: pci: Sanity check the bar index in find_shm_cap Date: Tue, 22 Mar 2022 11:36:23 +0800 [thread overview] Message-ID: <CACGkMEuEh+vsDok6hrp96kgGHkxbmzskFMJOouR3mo3d3VjwdQ@mail.gmail.com> (raw) In-Reply-To: <20220321154931.859511-1-keirf@google.com> On Mon, Mar 21, 2022 at 11:49 PM Keir Fraser <keirf@google.com> wrote: > > The bar index is used as an index into the device's resource list > and should be checked as within range for a standard bar. > > Signed-off-by: Keir Fraser <keirf@google.com> Patch looks good, do we need a similar check in vp_modern_map_capability()? Thanks > --- > drivers/virtio/virtio_pci_modern.c | 10 ++++++++-- > 1 file changed, 8 insertions(+), 2 deletions(-) > > diff --git a/drivers/virtio/virtio_pci_modern.c b/drivers/virtio/virtio_pci_modern.c > index 5455bc041fb6..84bace98dff5 100644 > --- a/drivers/virtio/virtio_pci_modern.c > +++ b/drivers/virtio/virtio_pci_modern.c > @@ -293,7 +293,7 @@ static int virtio_pci_find_shm_cap(struct pci_dev *dev, u8 required_id, > > for (pos = pci_find_capability(dev, PCI_CAP_ID_VNDR); pos > 0; > pos = pci_find_next_capability(dev, pos, PCI_CAP_ID_VNDR)) { > - u8 type, cap_len, id; > + u8 type, cap_len, id, res_bar; > u32 tmp32; > u64 res_offset, res_length; > > @@ -317,7 +317,12 @@ static int virtio_pci_find_shm_cap(struct pci_dev *dev, u8 required_id, > > /* Type, and ID match, looks good */ > pci_read_config_byte(dev, pos + offsetof(struct virtio_pci_cap, > - bar), bar); > + bar), &res_bar); > + if (res_bar >= PCI_STD_NUM_BARS) { > + dev_err(&dev->dev, "%s: shm cap with bad bar: %d\n", > + __func__, res_bar); > + continue; > + } > > /* Read the lower 32bit of length and offset */ > pci_read_config_dword(dev, pos + offsetof(struct virtio_pci_cap, > @@ -337,6 +342,7 @@ static int virtio_pci_find_shm_cap(struct pci_dev *dev, u8 required_id, > length_hi), &tmp32); > res_length |= ((u64)tmp32) << 32; > > + *bar = res_bar; > *offset = res_offset; > *len = res_length; > > -- > 2.35.1.894.gb6a874cedc-goog > _______________________________________________ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization
next prev parent reply other threads:[~2022-03-22 3:36 UTC|newest] Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-03-21 15:49 [PATCH] virtio: pci: Sanity check the bar index in find_shm_cap Keir Fraser 2022-03-22 3:36 ` Jason Wang [this message] 2022-03-22 3:36 ` Jason Wang 2022-03-22 9:20 ` Keir Fraser 2022-03-22 13:23 ` Michael S. Tsirkin 2022-03-22 13:23 ` Michael S. Tsirkin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=CACGkMEuEh+vsDok6hrp96kgGHkxbmzskFMJOouR3mo3d3VjwdQ@mail.gmail.com \ --to=jasowang@redhat.com \ --cc=keirf@google.com \ --cc=linux-kernel@vger.kernel.org \ --cc=mst@redhat.com \ --cc=virtualization@lists.linux-foundation.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.