[v2,pciutils] libpci: Fix intel_sanity_check() function

Commit Message

Pali Rohár Dec. 26, 2021, 10:47 p.m. UTC

Function intel_sanity_check() calls conf1_read() which access d->domain
field. But intel_sanity_check() does not initialize this field and so
conf1_read() access some random data on stack.

Tests showed that intel_sanity_check() always fails as in d->domain is
stored some non-zero number.

Fix this issue by zeroing struct pci_dev d in intel_sanity_check() as
sanity check is verifying PCI devices at domain 0.
---
v2: Remove explicit set of d->domain to zero.
---
 lib/i386-ports.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Martin Mareš Dec. 26, 2021, 10:50 p.m. UTC | #1

Hi!

> Function intel_sanity_check() calls conf1_read() which access d->domain
> field. But intel_sanity_check() does not initialize this field and so
> conf1_read() access some random data on stack.
> 
> Tests showed that intel_sanity_check() always fails as in d->domain is
> stored some non-zero number.
> 
> Fix this issue by zeroing struct pci_dev d in intel_sanity_check() as
> sanity check is verifying PCI devices at domain 0.

Thanks, applied.

				Martin

Patch

diff --git a/lib/i386-ports.c b/lib/i386-ports.c
index b3b752cb1f3f..2f90aa4cee0a 100644
--- a/lib/i386-ports.c
+++ b/lib/i386-ports.c
@@ -72,6 +72,7 @@  intel_sanity_check(struct pci_access *a, struct pci_methods *m)
 {
   struct pci_dev d;
 
+  memset(&d, 0, sizeof(d));
   a->debug("...sanity check");
   d.bus = 0;
   d.func = 0;