tyler.durden/audk
1
0
Fork 0
mirror of https://github.com/acidanthera/audk.git synced 2025-07-25 14:44:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

MdeModulePkg/PciHostBridge: Enhance boundary check in Io/Mem.Read/Write

Browse Source 
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Garrett Kirkendall <garrett.kirkendall@amd.com>
This commit is contained in:
Ruiyu Ni 2018-09-21 15:02:44 +08:00
parent 2939283f2d
commit 666d05a0ad
1 changed files with 23 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
MdeModulePkg/Bus/Pci/PciHostBridgeDxe/PciRootBridgeIo.c
View File

@ -301,6 +301,8 @@ CreateRootBridge (
@retval EFI_INVALID_PARAMETER Buffer is NULL. @retval EFI_INVALID_PARAMETER Buffer is NULL.
@retval EFI_INVALID_PARAMETER Address or Count is invalid.
@retval EFI_UNSUPPORTED The Buffer is not aligned for the given Width. @retval EFI_UNSUPPORTED The Buffer is not aligned for the given Width.
@retval EFI_UNSUPPORTED The address range specified by Address, Width, @retval EFI_UNSUPPORTED The address range specified by Address, Width,
@ -321,6 +323,7 @@ RootBridgeIoCheckParameter (
UINT64 Base; UINT64 Base;
UINT64 Limit; UINT64 Limit;
UINT32 Size; UINT32 Size;
UINT64 Length;
// //
// Check to see if Buffer is NULL // Check to see if Buffer is NULL
@ -337,7 +340,7 @@ RootBridgeIoCheckParameter (
} }
// //
// For FIFO type, the target address won't increase during the access, // For FIFO type, the device address won't increase during the access,
// so treat Count as 1 // so treat Count as 1
// //
if (Width >= EfiPciWidthFifoUint8 && Width <= EfiPciWidthFifoUint64) { if (Width >= EfiPciWidthFifoUint8 && Width <= EfiPciWidthFifoUint64) {
@ -347,6 +350,13 @@ RootBridgeIoCheckParameter (
Width = (EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_WIDTH) (Width & 0x03); Width = (EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_WIDTH) (Width & 0x03);
Size = 1 << Width; Size = 1 << Width;
//
// Make sure (Count * Size) doesn't exceed MAX_UINT64
//
if (Count > DivU64x32 (MAX_UINT64, Size)) {
return EFI_INVALID_PARAMETER;
}
// //
// Check to see if Address is aligned // Check to see if Address is aligned
// //
@ -354,6 +364,14 @@ RootBridgeIoCheckParameter (
return EFI_UNSUPPORTED; return EFI_UNSUPPORTED;
} }
//
// Make sure (Address + Count * Size) doesn't exceed MAX_UINT64
//
Length = MultU64x32 (Count, Size);
if (Address > MAX_UINT64 - Length) {
return EFI_INVALID_PARAMETER;
}
RootBridge = ROOT_BRIDGE_FROM_THIS (This); RootBridge = ROOT_BRIDGE_FROM_THIS (This);
// //
@ -372,7 +390,7 @@ RootBridgeIoCheckParameter (
// //
// Allow Legacy IO access // Allow Legacy IO access
// //
if (Address + MultU64x32 (Count, Size) <= 0x1000) { if (Address + Length <= 0x1000) {
if ((RootBridge->Attributes & ( if ((RootBridge->Attributes & (
EFI_PCI_ATTRIBUTE_ISA_IO | EFI_PCI_ATTRIBUTE_VGA_PALETTE_IO | EFI_PCI_ATTRIBUTE_VGA_IO | EFI_PCI_ATTRIBUTE_ISA_IO | EFI_PCI_ATTRIBUTE_VGA_PALETTE_IO | EFI_PCI_ATTRIBUTE_VGA_IO |
EFI_PCI_ATTRIBUTE_IDE_PRIMARY_IO | EFI_PCI_ATTRIBUTE_IDE_SECONDARY_IO | EFI_PCI_ATTRIBUTE_IDE_PRIMARY_IO | EFI_PCI_ATTRIBUTE_IDE_SECONDARY_IO |
@ -386,7 +404,7 @@ RootBridgeIoCheckParameter (
// //
// Allow Legacy MMIO access // Allow Legacy MMIO access
// //
if ((Address >= 0xA0000) && (Address + MultU64x32 (Count, Size)) <= 0xC0000) { if ((Address >= 0xA0000) && (Address + Length) <= 0xC0000) {
if ((RootBridge->Attributes & EFI_PCI_ATTRIBUTE_VGA_MEMORY) != 0) { if ((RootBridge->Attributes & EFI_PCI_ATTRIBUTE_VGA_MEMORY) != 0) {
return EFI_SUCCESS; return EFI_SUCCESS;
} }
@ -395,7 +413,7 @@ RootBridgeIoCheckParameter (
// By comparing the Address against Limit we know which range to be used // By comparing the Address against Limit we know which range to be used
// for checking // for checking
// //
if (Address + MultU64x32 (Count, Size) <= RootBridge->Mem.Limit + 1) { if (Address + Length <= RootBridge->Mem.Limit + 1) {
Base = RootBridge->Mem.Base; Base = RootBridge->Mem.Base;
Limit = RootBridge->Mem.Limit; Limit = RootBridge->Mem.Limit;
} else { } else {
@ -427,7 +445,7 @@ RootBridgeIoCheckParameter (
return EFI_INVALID_PARAMETER; return EFI_INVALID_PARAMETER;
} }
if (Address + MultU64x32 (Count, Size) > Limit + 1) { if (Address + Length > Limit + 1) {
return EFI_INVALID_PARAMETER; return EFI_INVALID_PARAMETER;
} }