From patchwork Tue Sep 29 11:34:07 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gabriele Paoloni X-Patchwork-Id: 523791 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3A2D61402A9 for ; Tue, 29 Sep 2015 21:27:52 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S964859AbbI2L1s (ORCPT ); Tue, 29 Sep 2015 07:27:48 -0400 Received: from szxga02-in.huawei.com ([119.145.14.65]:59212 "EHLO szxga02-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S964843AbbI2L1p (ORCPT ); Tue, 29 Sep 2015 07:27:45 -0400 Received: from 172.24.1.47 (EHLO SZXEML424-HUB.china.huawei.com) ([172.24.1.47]) by szxrg02-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id CTL70647; Tue, 29 Sep 2015 19:27:33 +0800 (CST) Received: from localhost.localdomain (10.67.212.75) by SZXEML424-HUB.china.huawei.com (10.82.67.153) with Microsoft SMTP Server id 14.3.235.1; Tue, 29 Sep 2015 19:27:22 +0800 From: Gabriele Paoloni To: , , CC: , , , , , , , Subject: [PATCH v4 3/3] PCI: designware: add sanity checks on the header offset in dw_pcie_cfg_read and dw_pcie_cfg_write Date: Tue, 29 Sep 2015 19:34:07 +0800 Message-ID: <1443526447-228817-4-git-send-email-gabriele.paoloni@huawei.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1443526447-228817-1-git-send-email-gabriele.paoloni@huawei.com> References: <1443526447-228817-1-git-send-email-gabriele.paoloni@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.67.212.75] X-CFilter-Loop: Reflected Sender: linux-pci-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-pci@vger.kernel.org From: gabriele paoloni This patch adds sanity checks on "where" input parameter in dw_pcie_cfg_read and dw_pcie_cfg_write. These checks make sure that offset passed in by the caller is not in conflict with the size of the PCI header field that is being read/written Signed-off-by: Gabriele Paoloni --- drivers/pci/host/pcie-designware.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/drivers/pci/host/pcie-designware.c b/drivers/pci/host/pcie-designware.c index d771fa5..719d2cd 100644 --- a/drivers/pci/host/pcie-designware.c +++ b/drivers/pci/host/pcie-designware.c @@ -82,11 +82,15 @@ static inline struct pcie_port *sys_to_pcie(struct pci_sys_data *sys) int dw_pcie_cfg_read(void __iomem *addr, int size, u32 *val) { - if (size == 4) + if (size == 4) { + if ((uintptr_t)addr & 3) + return PCIBIOS_BAD_REGISTER_NUMBER; *val = readl(addr); - else if (size == 2) + } else if (size == 2) { + if ((uintptr_t)addr & 1) + return PCIBIOS_BAD_REGISTER_NUMBER; *val = readw(addr); - else if (size == 1) + } else if (size == 1) *val = readb(addr); else return PCIBIOS_BAD_REGISTER_NUMBER; @@ -96,11 +100,15 @@ int dw_pcie_cfg_read(void __iomem *addr, int size, u32 *val) int dw_pcie_cfg_write(void __iomem *addr, int size, u32 val) { - if (size == 4) + if (size == 4) { + if ((uintptr_t)addr & 3) + return PCIBIOS_BAD_REGISTER_NUMBER; writel(val, addr); - else if (size == 2) + } else if (size == 2) { + if ((uintptr_t)addr & 1) + return PCIBIOS_BAD_REGISTER_NUMBER; writew(val, addr); - else if (size == 1) + } else if (size == 1) writeb(val, addr); else return PCIBIOS_BAD_REGISTER_NUMBER;