diff options
| author | Ruiyu Ni <ruiyu.ni@intel.com> | 2018-09-21 15:02:44 +0800 |
|---|---|---|
| committer | Ruiyu Ni <ruiyu.ni@intel.com> | 2018-09-26 12:12:49 +0800 |
| commit | 666d05a0ade67555a39a2191619e04a838ab2280 (patch) | |
| tree | 5938f2aeaf8e85d3d664bd80383e3964273f5fce /MdeModulePkg/Bus/Pci/PciHostBridgeDxe | |
| parent | 2939283f2df3b8a0871e9bc7b2dd3718146318f4 (diff) | |
| download | edk2-666d05a0ade67555a39a2191619e04a838ab2280.zip edk2-666d05a0ade67555a39a2191619e04a838ab2280.tar.gz edk2-666d05a0ade67555a39a2191619e04a838ab2280.tar.bz2 | |
MdeModulePkg/PciHostBridge: Enhance boundary check in Io/Mem.Read/Write
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Garrett Kirkendall <garrett.kirkendall@amd.com>
Diffstat (limited to 'MdeModulePkg/Bus/Pci/PciHostBridgeDxe')
| -rw-r--r-- | MdeModulePkg/Bus/Pci/PciHostBridgeDxe/PciRootBridgeIo.c | 28 |
1 files changed, 23 insertions, 5 deletions
diff --git a/MdeModulePkg/Bus/Pci/PciHostBridgeDxe/PciRootBridgeIo.c b/MdeModulePkg/Bus/Pci/PciHostBridgeDxe/PciRootBridgeIo.c index f8a1239..2c373e4 100644 --- a/MdeModulePkg/Bus/Pci/PciHostBridgeDxe/PciRootBridgeIo.c +++ b/MdeModulePkg/Bus/Pci/PciHostBridgeDxe/PciRootBridgeIo.c @@ -301,6 +301,8 @@ CreateRootBridge ( @retval EFI_INVALID_PARAMETER Buffer is NULL.
+ @retval EFI_INVALID_PARAMETER Address or Count is invalid.
+
@retval EFI_UNSUPPORTED The Buffer is not aligned for the given Width.
@retval EFI_UNSUPPORTED The address range specified by Address, Width,
@@ -321,6 +323,7 @@ RootBridgeIoCheckParameter ( UINT64 Base;
UINT64 Limit;
UINT32 Size;
+ UINT64 Length;
//
// Check to see if Buffer is NULL
@@ -337,7 +340,7 @@ RootBridgeIoCheckParameter ( }
//
- // For FIFO type, the target address won't increase during the access,
+ // For FIFO type, the device address won't increase during the access,
// so treat Count as 1
//
if (Width >= EfiPciWidthFifoUint8 && Width <= EfiPciWidthFifoUint64) {
@@ -348,12 +351,27 @@ RootBridgeIoCheckParameter ( Size = 1 << Width;
//
+ // Make sure (Count * Size) doesn't exceed MAX_UINT64
+ //
+ if (Count > DivU64x32 (MAX_UINT64, Size)) {
+ return EFI_INVALID_PARAMETER;
+ }
+
+ //
// Check to see if Address is aligned
//
if ((Address & (Size - 1)) != 0) {
return EFI_UNSUPPORTED;
}
+ //
+ // Make sure (Address + Count * Size) doesn't exceed MAX_UINT64
+ //
+ Length = MultU64x32 (Count, Size);
+ if (Address > MAX_UINT64 - Length) {
+ return EFI_INVALID_PARAMETER;
+ }
+
RootBridge = ROOT_BRIDGE_FROM_THIS (This);
//
@@ -372,7 +390,7 @@ RootBridgeIoCheckParameter ( //
// Allow Legacy IO access
//
- if (Address + MultU64x32 (Count, Size) <= 0x1000) {
+ if (Address + Length <= 0x1000) {
if ((RootBridge->Attributes & (
EFI_PCI_ATTRIBUTE_ISA_IO | EFI_PCI_ATTRIBUTE_VGA_PALETTE_IO | EFI_PCI_ATTRIBUTE_VGA_IO |
EFI_PCI_ATTRIBUTE_IDE_PRIMARY_IO | EFI_PCI_ATTRIBUTE_IDE_SECONDARY_IO |
@@ -386,7 +404,7 @@ RootBridgeIoCheckParameter ( //
// Allow Legacy MMIO access
//
- if ((Address >= 0xA0000) && (Address + MultU64x32 (Count, Size)) <= 0xC0000) {
+ if ((Address >= 0xA0000) && (Address + Length) <= 0xC0000) {
if ((RootBridge->Attributes & EFI_PCI_ATTRIBUTE_VGA_MEMORY) != 0) {
return EFI_SUCCESS;
}
@@ -395,7 +413,7 @@ RootBridgeIoCheckParameter ( // By comparing the Address against Limit we know which range to be used
// for checking
//
- if (Address + MultU64x32 (Count, Size) <= RootBridge->Mem.Limit + 1) {
+ if (Address + Length <= RootBridge->Mem.Limit + 1) {
Base = RootBridge->Mem.Base;
Limit = RootBridge->Mem.Limit;
} else {
@@ -427,7 +445,7 @@ RootBridgeIoCheckParameter ( return EFI_INVALID_PARAMETER;
}
- if (Address + MultU64x32 (Count, Size) > Limit + 1) {
+ if (Address + Length > Limit + 1) {
return EFI_INVALID_PARAMETER;
}
|