From nobody Mon May 16 15:24:42 2022 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 62B5E1AE34D1; Mon, 16 May 2022 15:24:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4L232f1yNGz3nVd; Mon, 16 May 2022 15:24:42 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1652714682; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=MTWSgWVy/s7nvGqhc7sCnL7x8nbm/et+m+EBfVHo7L0=; b=ha4RxNdc/UxtYeBqNbVO6dLiEbJdnyrPnZLLsA76HvpYxsSrYRod+FWTgRrP8MxXJiAW0B FWjuQMxxGWCDSI2K/40e98dqBmRGRCKNEls1r7i2dP51w6jMwdBBrznKbSeRyYS2GX5wCn xJRnVvf0ml77aynkDN3Ye1GFp5hqKL1bI33gOZ9T22PMNl8fUv5H9wcPg6Yv6be0LAe37I IrMvII8ZVctc4tyapQxaQWDeFABs8v7HvSyIBUl22lcIv6eXWS7IzPZ6MLTzPezLZL+uZE 5rZ9eDdNZ9M47X5LR2vr6O81NeOGY23K4ygA7VNJkRNIjkA/BfnCdBnbfVm9JA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 130A522769; Mon, 16 May 2022 15:24:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 24GFOgnJ006605; Mon, 16 May 2022 15:24:42 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 24GFOgEo006604; Mon, 16 May 2022 15:24:42 GMT (envelope-from git) Date: Mon, 16 May 2022 15:24:42 GMT Message-Id: <202205161524.24GFOgEo006604@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Emmanuel Vadot Subject: git: 1b3141c63046 - stable/13 - bhyve: avoid overflow of BAR index List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: manu X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 1b3141c63046b76ead1e26265d7301364e4c541c Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1652714682; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=MTWSgWVy/s7nvGqhc7sCnL7x8nbm/et+m+EBfVHo7L0=; b=FbhsDcXeN7o0/OnhVeOGDAD/KfdcZOz2vGgTXo05BGP/WzP3ZgGJae5OWgffYZAGYI5XNL 4GvcSRQhaI2GapmetuWgsKvHMfMDkq0OJjomGb3nYXyqyndiwzVz8hrEZMJ1wjguePc3jS Bcf3QW9vuunLqgryTR+ClZ5bv6V4sEqd0VIN0C97+4x0W/irbAaUG+/UVxR4QQMgJxgN9h IBNVThG6/2qwTxVdB+cBA7HVvvsDcimXBHUljrpNId1IEvLlybD7xMOcSUZur5gxVK7vpP 5YWgMi73zw0yReqe2fuopL0zbY+Or1jRoYngja4p5sRIGsrWKuhOAQ+tAXg14Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1652714682; a=rsa-sha256; cv=none; b=l9xYEbNFFkoFl8Tnmoswsvcvtk7bsGVsA/TVK4mH4rLMuvJpMgrQJUzjqtcvtmFg65r9iV 5YCCjrJgJBti3e1bWJoIu/fBMVJvuYvCI8CF1ukEOpfXgY8cumMBQqVgOnsbuFocC2NE3Z S/jPHVpmk7SI2ou6FGiKWC1gwitdY+yFGAVZxdYGO4DRbgA6P52tGqSRSK0+ZDnzbcoZ8c coTWFFWgmSFKA2PW438Bl+eKwuHfw5UmI3wjghajCnBGesfAaqKPZ0gg4RNLnA/gopIksC 77qIhAt3rxUBtiBtHNdz9iFg9L+6zIWj06M6isK+OtZWbot8h+7VvCxLAxW3aQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch stable/13 has been updated by manu: URL: https://cgit.FreeBSD.org/src/commit/?id=1b3141c63046b76ead1e26265d7301364e4c541c commit 1b3141c63046b76ead1e26265d7301364e4c541c Author: Corvin Köhne AuthorDate: 2022-04-01 08:18:52 +0000 Commit: Emmanuel Vadot CommitDate: 2022-05-16 15:24:33 +0000 bhyve: avoid overflow of BAR index At the moment, writes to BAR registers that aren't 4 byte aligned are ignored. So, there's no overflow yet. Nevertheless, if this behaviour changes in the future, it could unintentionally, introduce a buffer overflow. Additionally, some compiler or tools will detect this potential overflow and complain about it. Reviewed by: markj Signed-off-by: Corvin Köhne Reported-by: Andy Fiddaman Differential Revision: https://reviews.freebsd.org/D34689 (cherry picked from commit 45ddbf211274eb28c0ccd0042640de57015dd390) --- usr.sbin/bhyve/pci_emul.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/usr.sbin/bhyve/pci_emul.c b/usr.sbin/bhyve/pci_emul.c index 7b62b09b53f7..8cadc0580311 100644 --- a/usr.sbin/bhyve/pci_emul.c +++ b/usr.sbin/bhyve/pci_emul.c @@ -166,6 +166,18 @@ CFGREAD(struct pci_devinst *pi, int coff, int bytes) return (pci_get_cfgdata32(pi, coff)); } +static int +is_pcir_bar(int coff) +{ + return (coff >= PCIR_BAR(0) && coff < PCIR_BAR(PCI_BARMAX + 1)); +} + +static int +is_pcir_bios(int coff) +{ + return (coff >= PCIR_BIOS && coff < PCIR_BIOS + 4); +} + /* * I/O access */ @@ -2107,19 +2119,23 @@ pci_cfgrw(struct vmctx *ctx, int vcpu, int in, int bus, int slot, int func, /* * Special handling for write to BAR and ROM registers */ - if ((coff >= PCIR_BAR(0) && coff < PCIR_BAR(PCI_BARMAX + 1)) || - (coff >= PCIR_BIOS && coff < PCIR_BIOS + 4)) { + if (is_pcir_bar(coff) || is_pcir_bios(coff)) { /* * Ignore writes to BAR registers that are not * 4-byte aligned. */ if (bytes != 4 || (coff & 0x3) != 0) return; - if (coff != PCIR_BIOS) { + + if (is_pcir_bar(coff)) { idx = (coff - PCIR_BAR(0)) / 4; - } else { + } else if (is_pcir_bios(coff)) { idx = PCI_ROM_IDX; + } else { + errx(4, "%s: invalid BAR offset %d", __func__, + coff); } + mask = ~(pi->pi_bar[idx].size - 1); switch (pi->pi_bar[idx].type) { case PCIBAR_NONE: