shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-03-25 12:00:22 +09:00
Code Issues Packages Projects Releases Wiki Activity

BACKPORT: virtio: pci: check bar values read from virtio config space

Browse Source 
virtio pci config structures may in future have non-standard bar
values in the bar field. We should anticipate this by skipping any
structures containing such a reserved value.

The bar value should never change: check for harmful modified values
we re-read it from the config space in vp_modern_map_capability().

Also clean up an existing check to consistently use PCI_STD_NUM_BARS.

Signed-off-by: Keir Fraser <keirf@google.com>
Link: https://lore.kernel.org/r/20220323140727.3499235-1-keirf@google.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 3f63a1d7f6)
Bug: 222232623
[keirf@: Pass virtio_pci_device to map_capability. Move everything
into virtio_pci_modern.c]
Signed-off-by: Keir Fraser <keirf@google.com>
Change-Id: Idbba48154a051cf173b9cb0bd40c77fcf02902a4
This commit is contained in:
Keir Fraser
2022-04-01 10:44:41 +00:00
parent 7e5df18bee
commit aadf7ad9db
1 changed files with 24 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
drivers/virtio/virtio_pci_modern.c
View File

@@ -63,12 +63,13 @@ static void vp_iowrite64_twopart(u64 val,
vp_iowrite32(val >> 32, hi);
}
static void __iomem *map_capability(struct pci_dev *dev, int off,
static void __iomem *map_capability(struct virtio_pci_device *vp_dev, int off,
size_t minlen,
u32 align,
u32 start, u32 size,
size_t *len)
{
struct pci_dev *dev = vp_dev->pci_dev;
u8 bar;
u32 offset, length;
void __iomem *p;
@@ -81,6 +82,13 @@ static void __iomem *map_capability(struct pci_dev *dev, int off,
pci_read_config_dword(dev, off + offsetof(struct virtio_pci_cap, length),
&length);
/* Check if the BAR may have changed since we requested the region. */
if (bar >= PCI_STD_NUM_BARS || !(vp_dev->modern_bars & (1 << bar))) {
dev_err(&dev->dev,
"virtio_pci: bar unexpectedly changed to %u\n", bar);
return NULL;
}
if (length <= start) {
dev_err(&dev->dev,
"virtio_pci: bad capability len %u (>%u expected)\n",
@@ -370,7 +378,7 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,
vq->priv = (void __force *)vp_dev->notify_base +
off * vp_dev->notify_offset_multiplier;
} else {
vq->priv = (void __force *)map_capability(vp_dev->pci_dev,
vq->priv = (void __force *)map_capability(vp_dev,
vp_dev->notify_map_cap, 2, 2,
off * vp_dev->notify_offset_multiplier, 2,
NULL);
@@ -451,7 +459,7 @@ static int virtio_pci_find_shm_cap(struct pci_dev *dev, u8 required_id,
for (pos = pci_find_capability(dev, PCI_CAP_ID_VNDR); pos > 0;
pos = pci_find_next_capability(dev, pos, PCI_CAP_ID_VNDR)) {
u8 type, cap_len, id;
u8 type, cap_len, id, res_bar;
u32 tmp32;
u64 res_offset, res_length;
@@ -473,9 +481,14 @@ static int virtio_pci_find_shm_cap(struct pci_dev *dev, u8 required_id,
if (id != required_id)
continue;
/* Type, and ID match, looks good */
pci_read_config_byte(dev, pos + offsetof(struct virtio_pci_cap,
bar), bar);
bar), &res_bar);
if (res_bar >= PCI_STD_NUM_BARS)
continue;
/* Type and ID match, and the BAR value isn't reserved.
* Looks good.
*/
/* Read the lower 32bit of length and offset */
pci_read_config_dword(dev, pos + offsetof(struct virtio_pci_cap,
@@ -495,6 +508,7 @@ static int virtio_pci_find_shm_cap(struct pci_dev *dev, u8 required_id,
length_hi), &tmp32);
res_length |= ((u64)tmp32) << 32;
*bar = res_bar;
*offset = res_offset;
*len = res_length;
@@ -597,7 +611,7 @@ static inline int virtio_pci_find_capability(struct pci_dev *dev, u8 cfg_type,
&bar);
/* Ignore structures with reserved BAR values */
if (bar > 0x5)
if (bar >= PCI_STD_NUM_BARS)
continue;
if (type == cfg_type) {
@@ -743,13 +757,13 @@ int virtio_pci_modern_probe(struct virtio_pci_device *vp_dev)
return err;
err = -EINVAL;
vp_dev->common = map_capability(pci_dev, common,
vp_dev->common = map_capability(vp_dev, common,
sizeof(struct virtio_pci_common_cfg), 4,
0, sizeof(struct virtio_pci_common_cfg),
NULL);
if (!vp_dev->common)
goto err_map_common;
vp_dev->isr = map_capability(pci_dev, isr, sizeof(u8), 1,
vp_dev->isr = map_capability(vp_dev, isr, sizeof(u8), 1,
0, 1,
NULL);
if (!vp_dev->isr)
@@ -776,7 +790,7 @@ int virtio_pci_modern_probe(struct virtio_pci_device *vp_dev)
* Otherwise, map each VQ individually later.
*/
if ((u64)notify_length + (notify_offset % PAGE_SIZE) <= PAGE_SIZE) {
vp_dev->notify_base = map_capability(pci_dev, notify, 2, 2,
vp_dev->notify_base = map_capability(vp_dev, notify, 2, 2,
0, notify_length,
&vp_dev->notify_len);
if (!vp_dev->notify_base)
@@ -789,7 +803,7 @@ int virtio_pci_modern_probe(struct virtio_pci_device *vp_dev)
* is more than enough for all existing devices.
*/
if (device) {
vp_dev->device = map_capability(pci_dev, device, 0, 4,
vp_dev->device = map_capability(vp_dev, device, 0, 4,
0, PAGE_SIZE,
&vp_dev->device_len);
if (!vp_dev->device)