random-mirrors/smaeul-u-boot
1
0
Fork 0
mirror of https://github.com/smaeul/u-boot.git synced 2025-10-14 12:56:00 +01:00
Code Issues Packages Projects Releases Wiki Activity

virtio: pci: Bounds check device config access

Browse Source 
The device config is optional, so check it was present and mapped before
trying to use the pointer. Bounds violations are an error, not just a
warning, so bail if the checks fail.

Signed-off-by: Andrew Scull <ascull@google.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
This commit is contained in:
Andrew Scull 2022-04-21 16:11:01 +00:00 committed by Tom Rini
parent da03cdfa7a
commit 94b28b9158
1 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/virtio/virtio_pci_modern.c
View File

@ -114,7 +114,11 @@ static int virtio_pci_get_config(struct udevice *udev, unsigned int offset,
__le16 w; __le16 w;
__le32 l; __le32 l;
WARN_ON(offset + len > priv->device_len); if (!priv->device)
return -ENOSYS;
if (offset + len > priv->device_len)
return -EINVAL;
switch (len) { switch (len) {
case 1: case 1:
@ -136,7 +140,7 @@ static int virtio_pci_get_config(struct udevice *udev, unsigned int offset,
memcpy(buf + sizeof(l), &l, sizeof(l)); memcpy(buf + sizeof(l), &l, sizeof(l));
break; break;
default: default:
WARN_ON(true); return -EINVAL;
} }
return 0; return 0;
@ -150,7 +154,11 @@ static int virtio_pci_set_config(struct udevice *udev, unsigned int offset,
__le16 w; __le16 w;
__le32 l; __le32 l;
WARN_ON(offset + len > priv->device_len); if (!priv->device)
return -ENOSYS;
if (offset + len > priv->device_len)
return -EINVAL;
switch (len) { switch (len) {
case 1: case 1:
@ -172,7 +180,7 @@ static int virtio_pci_set_config(struct udevice *udev, unsigned int offset,
iowrite32(le32_to_cpu(l), priv->device + offset + sizeof(l)); iowrite32(le32_to_cpu(l), priv->device + offset + sizeof(l));
break; break;
default: default:
WARN_ON(true); return -EINVAL;
} }
return 0; return 0;