From patchwork Thu Apr 28 11:04:52 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexey Kardashevskiy X-Patchwork-Id: 8968521 Return-Path: X-Original-To: patchwork-kvm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 2FE9A9F441 for ; Thu, 28 Apr 2016 11:06:27 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 2E8EF20166 for ; Thu, 28 Apr 2016 11:06:26 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 3B885201C8 for ; Thu, 28 Apr 2016 11:06:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752194AbcD1LGE (ORCPT ); Thu, 28 Apr 2016 07:06:04 -0400 Received: from e23smtp08.au.ibm.com ([202.81.31.141]:57506 "EHLO e23smtp08.au.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750932AbcD1LGB (ORCPT ); Thu, 28 Apr 2016 07:06:01 -0400 Received: from localhost by e23smtp08.au.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Thu, 28 Apr 2016 21:05:58 +1000 Received: from d23dlp01.au.ibm.com (202.81.31.203) by e23smtp08.au.ibm.com (202.81.31.205) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Thu, 28 Apr 2016 21:05:56 +1000 X-IBM-Helo: d23dlp01.au.ibm.com X-IBM-MailFrom: aik@ozlabs.ru X-IBM-RcptTo: kvm@vger.kernel.org;linux-kernel@vger.kernel.org Received: from d23relay07.au.ibm.com (d23relay07.au.ibm.com [9.190.26.37]) by d23dlp01.au.ibm.com (Postfix) with ESMTP id 8430A2CE8046; Thu, 28 Apr 2016 21:05:55 +1000 (EST) Received: from d23av02.au.ibm.com (d23av02.au.ibm.com [9.190.235.138]) by d23relay07.au.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id u3SB5liW1704204; Thu, 28 Apr 2016 21:05:55 +1000 Received: from d23av02.au.ibm.com (localhost [127.0.0.1]) by d23av02.au.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id u3SB5M0L000338; Thu, 28 Apr 2016 21:05:22 +1000 Received: from ozlabs.au.ibm.com (ozlabs.au.ibm.com [9.192.253.14]) by d23av02.au.ibm.com (8.14.4/8.14.4/NCO v10.0 AVin) with ESMTP id u3SB5Mon031888; Thu, 28 Apr 2016 21:05:22 +1000 Received: from bran.ozlabs.ibm.com (haven.au.ibm.com [9.192.254.114]) by ozlabs.au.ibm.com (Postfix) with ESMTP id 5734BA0268; Thu, 28 Apr 2016 21:04:57 +1000 (AEST) Received: from vpl2.ozlabs.ibm.com (vpl2.ozlabs.ibm.com [10.61.141.27]) by bran.ozlabs.ibm.com (Postfix) with ESMTP id 5505CE3A2D; Thu, 28 Apr 2016 21:04:57 +1000 (AEST) From: Alexey Kardashevskiy To: Alex Williamson Cc: Alexey Kardashevskiy , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Benjamin Herrenschmidt , Gavin Shan , Alistair Popple Subject: [PATCH kernel] vfio_pci: Make extended capabilities test more robust Date: Thu, 28 Apr 2016 21:04:52 +1000 Message-Id: <1461841492-29277-1-git-send-email-aik@ozlabs.ru> X-Mailer: git-send-email 2.5.0.rc3 X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 16042811-0029-0000-0000-0000457A48E4 Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Spam-Status: No, score=-7.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP VFIO reads a dword beyond the standard PCI config space (256 bytes) to know if there are extended config space (4096 bytes). It relies on the platform to return zero if there is no extended space. However at least on PPC64/POWERNV platform, the system firmware (OPAL) returns 0xffffffff in this case. VFIO treats it as a proof that there is extended config space and calls vfio_ecap_init() which fails to parse capabilities (which is expected) but right before the exit, it writes zero at offset of 256 which is beyond the buffer allocated for vdev->vconfig - it is 256 bytes for a device without extended config space. This adds an additional check that config space read returned non-zero and non-ffffffff value. Signed-off-by: Alexey Kardashevskiy --- drivers/vfio/pci/vfio_pci_config.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c index 142c533..8a53421 100644 --- a/drivers/vfio/pci/vfio_pci_config.c +++ b/drivers/vfio/pci/vfio_pci_config.c @@ -1140,7 +1140,7 @@ static int vfio_cap_len(struct vfio_pci_device *vdev, u8 cap, u8 pos) case PCI_CAP_ID_EXP: /* Test for extended capabilities */ pci_read_config_dword(pdev, PCI_CFG_SPACE_SIZE, &dword); - vdev->extended_caps = (dword != 0); + vdev->extended_caps = (dword != 0) && (dword != 0xffffffff); /* length based on version */ if ((pcie_caps_reg(pdev) & PCI_EXP_FLAGS_VERS) == 1)