From patchwork Fri Sep 11 09:38:27 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gabriele Paoloni X-Patchwork-Id: 7158931 X-Patchwork-Delegate: bhelgaas@google.com Return-Path: X-Original-To: patchwork-linux-pci@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id C80EEBEEC1 for ; Fri, 11 Sep 2015 09:31:54 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id E49CF20684 for ; Fri, 11 Sep 2015 09:31:53 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0F46920489 for ; Fri, 11 Sep 2015 09:31:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751986AbbIKJbv (ORCPT ); Fri, 11 Sep 2015 05:31:51 -0400 Received: from szxga03-in.huawei.com ([119.145.14.66]:9352 "EHLO szxga03-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751600AbbIKJbt (ORCPT ); Fri, 11 Sep 2015 05:31:49 -0400 Received: from 172.24.1.47 (EHLO szxeml431-hub.china.huawei.com) ([172.24.1.47]) by szxrg03-dlp.huawei.com (MOS 4.4.3-GA FastPath queued) with ESMTP id BMS32289; Fri, 11 Sep 2015 17:31:47 +0800 (CST) Received: from localhost.localdomain (10.67.212.75) by szxeml431-hub.china.huawei.com (10.82.67.208) with Microsoft SMTP Server id 14.3.235.1; Fri, 11 Sep 2015 17:31:37 +0800 From: Gabriele Paoloni To: , , CC: , , , , , , , Subject: [PATCH v3 3/3] PCI: designware: add sanity checks on the header offset in dw_pcie_cfg_read and dw_pcie_cfg_write Date: Fri, 11 Sep 2015 17:38:27 +0800 Message-ID: <1441964307-126942-4-git-send-email-gabriele.paoloni@huawei.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1441964307-126942-1-git-send-email-gabriele.paoloni@huawei.com> References: <1441964307-126942-1-git-send-email-gabriele.paoloni@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.67.212.75] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020206.55F29F83.0134, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=0.0.0.0, so=2013-05-26 15:14:31, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 981714e53be6cec4af704fb50a76d21a Sender: linux-pci-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-pci@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: gabriele paoloni This patch adds sanity checks on "where" input parameter in dw_pcie_cfg_read and dw_pcie_cfg_write. These checks make sure that offset passed in by the caller is not in conflict with the size of the PCI header field that is being read/written Signed-off-by: Gabriele Paoloni --- drivers/pci/host/pcie-designware.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/drivers/pci/host/pcie-designware.c b/drivers/pci/host/pcie-designware.c index cb23e31..6812f69 100644 --- a/drivers/pci/host/pcie-designware.c +++ b/drivers/pci/host/pcie-designware.c @@ -88,9 +88,14 @@ int dw_pcie_cfg_read(void __iomem *addr, int where, int size, u32 *val) if (size == 1) *val = (*val >> (8 * where)) & 0xff; - else if (size == 2) + else if (size == 2) { + if (where & 1) + return PCIBIOS_BAD_REGISTER_NUMBER; *val = (*val >> (8 * where)) & 0xffff; - else if (size != 4) + } else if (size == 4) { + if (where & 3) + return PCIBIOS_BAD_REGISTER_NUMBER; + } else return PCIBIOS_BAD_REGISTER_NUMBER; return PCIBIOS_SUCCESSFUL; @@ -100,11 +105,15 @@ int dw_pcie_cfg_write(void __iomem *addr, int where, int size, u32 val) { addr += where; - if (size == 4) + if (size == 4) { + if ((uintptr_t)addr & 3) + return PCIBIOS_BAD_REGISTER_NUMBER; writel(val, addr); - else if (size == 2) + } else if (size == 2) { + if ((uintptr_t)addr & 1) + return PCIBIOS_BAD_REGISTER_NUMBER; writew(val, addr); - else if (size == 1) + } else if (size == 1) writeb(val, addr); else return PCIBIOS_BAD_REGISTER_NUMBER;