From patchwork Thu Jan 19 17:06:33 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Alexander Shishkin X-Patchwork-Id: 13108389 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 23229C678DD for ; Thu, 19 Jan 2023 17:10:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230034AbjASRKx (ORCPT ); Thu, 19 Jan 2023 12:10:53 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54244 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229784AbjASRKv (ORCPT ); Thu, 19 Jan 2023 12:10:51 -0500 Received: from mga17.intel.com (mga17.intel.com [192.55.52.151]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D83EFA5CB; Thu, 19 Jan 2023 09:10:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1674148248; x=1705684248; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=a1Xl5AI0jRujcTSH5TR69MwUM/ZMR3gvrCrzmKfX45M=; b=imGN8q9gbYCE0bDV8Q8VgIm/UqwL/J2OUkx9ZBaWKy/iUlVANbR+Wj/l CWDDPZ3niEk15VBBx/zP8+TDoy3nFyTLimIWj9u+ro8lOvRE2OOjEzj1L YEnYMUUCBV4atn6J7h/evUNa6Mo1HUwz5LBn6eL4BJzIDSr6UGPb+Kzn6 LPF/IMVuFgv9Wj7pc8u+bNeZbAPjn6sbMZggtL7RZK7gks+9A1pwKa+29 cwVHYhWPOuUv6b4dKy9Wvuj/dnk/Dj3mMHf1YqwVoqpqME4Kg6q8IK4oC 1RLhnUoZbmYFYNA6dpV4MJXLrbtriumNegsCBGnffZQaSip5Tc/3PTxZc g==; X-IronPort-AV: E=McAfee;i="6500,9779,10595"; a="305714699" X-IronPort-AV: E=Sophos;i="5.97,229,1669104000"; d="scan'208";a="305714699" Received: from orsmga004.jf.intel.com ([10.7.209.38]) by fmsmga107.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 19 Jan 2023 09:06:23 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6500,9779,10595"; a="784124777" X-IronPort-AV: E=Sophos;i="5.97,229,1669104000"; d="scan'208";a="784124777" Received: from black.fi.intel.com (HELO black.fi.intel.com.) ([10.237.72.28]) by orsmga004.jf.intel.com with ESMTP; 19 Jan 2023 09:06:20 -0800 From: Alexander Shishkin To: Bjorn Helgaas , Thomas Gleixner , linux-pci@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Marc Zyngier , darwi@linutronix.de, elena.reshetova@intel.com, kirill.shutemov@linux.intel.com, Alexander Shishkin , Mika Westerberg , =?utf-8?q?Ilpo_J=C3=A4rv?= =?utf-8?q?inen?= , stable@vger.kernel.org Subject: [PATCH 2/2] PCI/MSI: Validate device supplied MSI table offset and size Date: Thu, 19 Jan 2023 19:06:33 +0200 Message-Id: <20230119170633.40944-3-alexander.shishkin@linux.intel.com> X-Mailer: git-send-email 2.39.0 In-Reply-To: <20230119170633.40944-1-alexander.shishkin@linux.intel.com> References: <20230119170633.40944-1-alexander.shishkin@linux.intel.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-pci@vger.kernel.org Currently, the MSI table offset supplied by device's config space is passed directly into ioremap() without validation, allowing, for example, a malicious VMM to trick the OS into exposing its private memory. Correct this by making sure the table with the given number of vectors fits into its BIR starting at the provided table offset. Signed-off-by: Alexander Shishkin Reported-by: Elena Reshetova Reviewed-by: Mika Westerberg Reviewed-by: Ilpo Järvinen Cc: stable@vger.kernel.org --- drivers/pci/msi/msi.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c index d50cd45119f1..e93e633cb6a3 100644 --- a/drivers/pci/msi/msi.c +++ b/drivers/pci/msi/msi.c @@ -552,7 +552,8 @@ static void __iomem *msix_map_region(struct pci_dev *dev, unsigned int nr_entries) { resource_size_t phys_addr; - u32 table_offset; + u32 table_offset, table_size; + resource_size_t bir_size; unsigned long flags; u8 bir; @@ -563,10 +564,15 @@ static void __iomem *msix_map_region(struct pci_dev *dev, if (!flags || (flags & IORESOURCE_UNSET)) return NULL; + bir_size = pci_resource_len(dev, bir); + table_size = nr_entries * PCI_MSIX_ENTRY_SIZE; table_offset &= PCI_MSIX_TABLE_OFFSET; + if (bir_size < table_size || table_offset > bir_size - table_size) + return NULL; + phys_addr = pci_resource_start(dev, bir) + table_offset; - return ioremap(phys_addr, nr_entries * PCI_MSIX_ENTRY_SIZE); + return ioremap(phys_addr, table_size); } /**