xfnw/plan9fox
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

sdiahci: sanitize ahci pci bar

Browse source 
make sure the ahci pci bar is not in i/o space and has
the right size. also make sure Aport registers are within
the ahci bar range.
This commit is contained in:
cinap_lenrek 2015-01-04 04:26:58 +01:00
parent b5008f3b56
commit 5b24195a0a
1 changed files with 8 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

12
sys/src/9/pc/sdiahci.c
View file

@ -2159,8 +2159,10 @@ iapnp(void)
while((p = pcimatch(p, 0, 0)) != nil){ while((p = pcimatch(p, 0, 0)) != nil){
if((type = didtype(p)) == -1) if((type = didtype(p)) == -1)
continue; continue;
if(p->mem[Abar].bar == 0) io = p->mem[Abar].bar;
if(io == 0 || (io & 1) != 0 || p->mem[Abar].size < 0x180)
continue; continue;
io &= ~0xf;
if(niactlr == NCtlr){ if(niactlr == NCtlr){
print("iapnp: %s: too many controllers\n", tname[type]); print("iapnp: %s: too many controllers\n", tname[type]);
break; break;
@ -2169,7 +2171,6 @@ iapnp(void)
s = sdevs + niactlr; s = sdevs + niactlr;
memset(c, 0, sizeof *c); memset(c, 0, sizeof *c);
memset(s, 0, sizeof *s); memset(s, 0, sizeof *s);
io = p->mem[Abar].bar & ~0xf;
c->mmio = vmap(io, p->mem[Abar].size); c->mmio = vmap(io, p->mem[Abar].size);
if(c->mmio == 0){ if(c->mmio == 0){
print("%s: address %#p in use did %.4ux\n", print("%s: address %#p in use did %.4ux\n",
@ -2208,11 +2209,14 @@ iapnp(void)
d->ctlr = c; d->ctlr = c;
if((c->hba->pi & 1<<i) == 0) if((c->hba->pi & 1<<i) == 0)
continue; continue;
snprint(d->name, sizeof d->name, "iahci%d.%d", niactlr, i); io = 0x100 + 0x80*i;
d->port = (Aport*)(c->mmio + 0x80*i + 0x100); if((io + 0x80) > p->mem[Abar].size)
continue;
d->port = (Aport*)(c->mmio + io);
d->portc.p = d->port; d->portc.p = d->port;
d->portc.m = &d->portm; d->portc.m = &d->portm;
d->driveno = n++; d->driveno = n++;
snprint(d->name, sizeof d->name, "iahci%d.%d", niactlr, i);
c->drive[d->driveno] = d; c->drive[d->driveno] = d;
iadrive[niadrive + d->driveno] = d; iadrive[niadrive + d->driveno] = d;
} }