From: gabriele paoloni <gabriele.paoloni@xxxxxxxxxx>
This patch adds sanity checks on "where" input parameter in
dw_pcie_cfg_read and dw_pcie_cfg_write. These checks make sure
that offset passed in by the caller is not in conflict with
the size of the PCI header field that is being read/written
Signed-off-by: Gabriele Paoloni <gabriele.paoloni@xxxxxxxxxx>
---
drivers/pci/host/pcie-designware.c | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
diff --git a/drivers/pci/host/pcie-designware.c b/drivers/pci/host/pcie-designware.c
index d771fa5..719d2cd 100644
--- a/drivers/pci/host/pcie-designware.c
+++ b/drivers/pci/host/pcie-designware.c
@@ -82,11 +82,15 @@ static inline struct pcie_port *sys_to_pcie(struct pci_sys_data *sys)
int dw_pcie_cfg_read(void __iomem *addr, int size, u32 *val)
{
- if (size == 4)
+ if (size == 4) {
+ if ((uintptr_t)addr & 3)
+ return PCIBIOS_BAD_REGISTER_NUMBER;
*val = readl(addr);
- else if (size == 2)
+ } else if (size == 2) {
+ if ((uintptr_t)addr & 1)
+ return PCIBIOS_BAD_REGISTER_NUMBER;
*val = readw(addr);
- else if (size == 1)
+ } else if (size == 1)
*val = readb(addr);
else
return PCIBIOS_BAD_REGISTER_NUMBER;
@@ -96,11 +100,15 @@ int dw_pcie_cfg_read(void __iomem *addr, int size, u32 *val)
int dw_pcie_cfg_write(void __iomem *addr, int size, u32 val)
{
- if (size == 4)
+ if (size == 4) {
+ if ((uintptr_t)addr & 3)
+ return PCIBIOS_BAD_REGISTER_NUMBER;
writel(val, addr);
- else if (size == 2)
+ } else if (size == 2) {
+ if ((uintptr_t)addr & 1)
+ return PCIBIOS_BAD_REGISTER_NUMBER;
writew(val, addr);
- else if (size == 1)
+ } else if (size == 1)
writeb(val, addr);
else
return PCIBIOS_BAD_REGISTER_NUMBER;
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-pci" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
