From patchwork Mon Aug 11 04:36:55 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Benjamin Herrenschmidt X-Patchwork-Id: 378882 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id CF95E140141 for ; Mon, 11 Aug 2014 14:37:04 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750720AbaHKEhD (ORCPT ); Mon, 11 Aug 2014 00:37:03 -0400 Received: from gate.crashing.org ([63.228.1.57]:38141 "EHLO gate.crashing.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751174AbaHKEhB (ORCPT ); Mon, 11 Aug 2014 00:37:01 -0400 Received: from localhost (localhost.localdomain [127.0.0.1]) by gate.crashing.org (8.14.1/8.13.8) with ESMTP id s7B4auts013215; Sun, 10 Aug 2014 23:36:57 -0500 Message-ID: <1407731815.4508.69.camel@pasglop> Subject: [PATCH] pci/msi-x: Sanity check MSI-X table offset From: Benjamin Herrenschmidt To: Bjorn Helgaas Cc: Linux PCI Date: Mon, 11 Aug 2014 14:36:55 +1000 X-Mailer: Evolution 3.12.2 Mime-Version: 1.0 Sender: linux-pci-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-pci@vger.kernel.org If the hardware device mis-behaves (such as for example crashes or gets unplugged at the wrong time) and provides us with a bogus MSI-X table offset, all sorts of "interesting" and potentially very hard to debug things can happen. For example, on POWER8, such a device caused us to ioremap an area outside of the region assigned to the PCI bus, causing subsequent accesses to cause a PowerBus timeout and checkstop the machine. Since this isn't a hot path, let's add a good dose of sanity checking to msix_map_region() to flag these issues early and limit the damage. Signed-off-by: Benjamin Herrenschmidt --- drivers/pci/msi.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) -- To unsubscribe from this list: send the line "unsubscribe linux-pci" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c index 5a40516..a584f590 100644 --- a/drivers/pci/msi.c +++ b/drivers/pci/msi.c @@ -666,13 +666,30 @@ static int msi_capability_init(struct pci_dev *dev, int nvec) static void __iomem *msix_map_region(struct pci_dev *dev, unsigned nr_entries) { resource_size_t phys_addr; - u32 table_offset; + u32 table_offset, table_end; u8 bir; pci_read_config_dword(dev, dev->msix_cap + PCI_MSIX_TABLE, &table_offset); bir = (u8)(table_offset & PCI_MSIX_TABLE_BIR); + if (bir >= DEVICE_COUNT_RESOURCE) { + dev_err(&dev->dev, "MSI-X points to non-exiting BAR %d !\n", + bir); + return NULL; + } + if ((pci_resource_flags(dev, bir) & IORESOURCE_MEM) == 0) { + dev_err(&dev->dev, "MSI-X points to non-memory BAR %d !\n", + bir); + return NULL; + } table_offset &= PCI_MSIX_TABLE_OFFSET; + table_end = table_offset + nr_entries * PCI_MSIX_ENTRY_SIZE; + if (table_end <= table_offset || + table_end > pci_resource_len(dev, bir)) { + dev_err(&dev->dev, "MSI-X table outside of BAR boundary !" + " (0x%08x..%08x)\n", table_offset, table_end); + return NULL; + } phys_addr = pci_resource_start(dev, bir) + table_offset; return ioremap_nocache(phys_addr, nr_entries * PCI_MSIX_ENTRY_SIZE);