tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

NetworkPkg/SnpDxe: Prevent invalid PCI BAR access 

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1563

SnpDxe initializes values for MemoryBarIndex and IoBarIndex to 0 and 1
respectively even if calls to PciIo->GetBarAttributes never return
success.

Later, if the BAR is used to perform IO/Mem reads/writes, a potentially
non-existent BAR index may be accessed. This change initializes the
values
to an invalid BAR index (PCI_MAX_BAR) so the condition can be explicitly
checked to avoid an invalid BAR access.

Cc: Siyuan Fu <siyuan.fu@intel.com>
Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>
Cc: Jiaxin Wu <jiaxin.wu@intel.com>
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>
Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
This commit is contained in:
Michael Kubacki 2020-04-08 20:02:05 -07:00 committed by mergify[bot]
parent ca08f3d453
commit df4f154da9
2 changed files with 47 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

77
NetworkPkg/SnpDxe/Callback.c
View File

@ -4,6 +4,7 @@
stores the interface context for the NIC that snp is trying to talk.
Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>
Copyright (c) Microsoft Corporation.<BR>
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
@ -115,47 +116,59 @@ SnpUndi32CallbackMemio (
switch (ReadOrWrite) {
case PXE_IO_READ:
Snp->PciIo->Io.Read (
Snp->PciIo,
Width,
Snp->IoBarIndex, // BAR 1 (for 32bit regs), IO base address
MemOrPortAddr,
1, // count
(VOID *) (UINTN) BufferPtr
);
ASSERT (Snp->IoBarIndex < PCI_MAX_BAR);
if (Snp->IoBarIndex < PCI_MAX_BAR) {
Snp->PciIo->Io.Read (
Snp->PciIo,
Width,
Snp->IoBarIndex, // BAR 1 (for 32bit regs), IO base address
MemOrPortAddr,
1, // count
(VOID *) (UINTN) BufferPtr
);
}
break;
case PXE_IO_WRITE:
Snp->PciIo->Io.Write (
Snp->PciIo,
Width,
Snp->IoBarIndex, // BAR 1 (for 32bit regs), IO base address
MemOrPortAddr,
1, // count
(VOID *) (UINTN) BufferPtr
);
ASSERT (Snp->IoBarIndex < PCI_MAX_BAR);
if (Snp->IoBarIndex < PCI_MAX_BAR) {
Snp->PciIo->Io.Write (
Snp->PciIo,
Width,
Snp->IoBarIndex, // BAR 1 (for 32bit regs), IO base address
MemOrPortAddr,
1, // count
(VOID *) (UINTN) BufferPtr
);
}
break;
case PXE_MEM_READ:
Snp->PciIo->Mem.Read (
Snp->PciIo,
Width,
Snp->MemoryBarIndex, // BAR 0, Memory base address
MemOrPortAddr,
1, // count
(VOID *) (UINTN) BufferPtr
);
ASSERT (Snp->MemoryBarIndex < PCI_MAX_BAR);
if (Snp->MemoryBarIndex < PCI_MAX_BAR) {
Snp->PciIo->Mem.Read (
Snp->PciIo,
Width,
Snp->MemoryBarIndex, // BAR 0, Memory base address
MemOrPortAddr,
1, // count
(VOID *) (UINTN) BufferPtr
);
}
break;
case PXE_MEM_WRITE:
Snp->PciIo->Mem.Write (
Snp->PciIo,
Width,
Snp->MemoryBarIndex, // BAR 0, Memory base address
MemOrPortAddr,
1, // count
(VOID *) (UINTN) BufferPtr
);
ASSERT (Snp->MemoryBarIndex < PCI_MAX_BAR);
if (Snp->MemoryBarIndex < PCI_MAX_BAR) {
Snp->PciIo->Mem.Write (
Snp->PciIo,
Width,
Snp->MemoryBarIndex, // BAR 0, Memory base address
MemOrPortAddr,
1, // count
(VOID *) (UINTN) BufferPtr
);
}
break;
}

4
NetworkPkg/SnpDxe/Snp.c
View File

@ -466,8 +466,8 @@ SimpleNetworkDriverStart (
// the IO BAR. Save the index of the BAR into the adapter info structure.
// for regular 32bit BARs, 0 is memory mapped, 1 is io mapped
//
Snp->MemoryBarIndex = 0;
Snp->IoBarIndex = 1;
Snp->MemoryBarIndex = PCI_MAX_BAR;
Snp->IoBarIndex = PCI_MAX_BAR;
FoundMemoryBar = FALSE;
FoundIoBar = FALSE;
for (BarIndex = 0; BarIndex < PCI_MAX_BAR; BarIndex++) {