public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: "Siyuan, Fu" <siyuan.fu@intel.com>
To: "devel@edk2.groups.io" <devel@edk2.groups.io>,
	"michael.kubacki@outlook.com" <michael.kubacki@outlook.com>
Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>,
	"Wu, Jiaxin" <jiaxin.wu@intel.com>
Subject: Re: [edk2-devel] [PATCH v1 1/1] NetworkPkg/SnpDxe: Prevent invalid PCI BAR access
Date: Fri, 17 Apr 2020 02:51:14 +0000	[thread overview]
Message-ID: <B1FF2E9001CE9041BD10B825821D5BC58B9F86FD@SHSMSX103.ccr.corp.intel.com> (raw)
In-Reply-To: <MWHPR07MB34402BD8F4D421DF24B53947E9C10@MWHPR07MB3440.namprd07.prod.outlook.com>

Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>

> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Michael
> Kubacki
> Sent: 2020年4月9日 11:02
> To: devel@edk2.groups.io
> Cc: Fu, Siyuan <siyuan.fu@intel.com>; Maciej Rabeda
> <maciej.rabeda@linux.intel.com>; Wu, Jiaxin <jiaxin.wu@intel.com>
> Subject: [edk2-devel] [PATCH v1 1/1] NetworkPkg/SnpDxe: Prevent invalid PCI
> BAR access
> 
> From: Michael Kubacki <michael.kubacki@microsoft.com>
> 
> REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1563
> 
> SnpDxe initializes values for MemoryBarIndex and IoBarIndex to 0 and 1
> respectively even if calls to PciIo->GetBarAttributes never return
> success.
> 
> Later, if the BAR is used to perform IO/Mem reads/writes, a potentially
> non-existent BAR index may be accessed. This change initializes the values
> to an invalid BAR index (PCI_MAX_BAR) so the condition can be explicitly
> checked to avoid an invalid BAR access.
> 
> Cc: Siyuan Fu <siyuan.fu@intel.com>
> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>
> Cc: Jiaxin Wu <jiaxin.wu@intel.com>
> Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
> ---
>  NetworkPkg/SnpDxe/Callback.c | 77 ++++++++++++--------
>  NetworkPkg/SnpDxe/Snp.c      |  5 +-
>  2 files changed, 48 insertions(+), 34 deletions(-)
> 
> diff --git a/NetworkPkg/SnpDxe/Callback.c b/NetworkPkg/SnpDxe/Callback.c
> index 0c0b81fdca8e..99b7fd3ef835 100644
> --- a/NetworkPkg/SnpDxe/Callback.c
> +++ b/NetworkPkg/SnpDxe/Callback.c
> @@ -4,6 +4,7 @@
>    stores the interface context for the NIC that snp is trying to talk.
> 
>  Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>
> +Copyright (c) Microsoft Corporation.<BR>
>  SPDX-License-Identifier: BSD-2-Clause-Patent
> 
>  **/
> @@ -115,47 +116,59 @@ SnpUndi32CallbackMemio (
> 
>    switch (ReadOrWrite) {
>    case PXE_IO_READ:
> -    Snp->PciIo->Io.Read (
> -                     Snp->PciIo,
> -                     Width,
> -                     Snp->IoBarIndex,      // BAR 1 (for 32bit regs), IO base address
> -                     MemOrPortAddr,
> -                     1,                    // count
> -                     (VOID *) (UINTN) BufferPtr
> -                     );
> +    ASSERT (Snp->IoBarIndex < PCI_MAX_BAR);
> +    if (Snp->IoBarIndex < PCI_MAX_BAR) {
> +      Snp->PciIo->Io.Read (
> +                       Snp->PciIo,
> +                       Width,
> +                       Snp->IoBarIndex,      // BAR 1 (for 32bit regs), IO base address
> +                       MemOrPortAddr,
> +                       1,                    // count
> +                       (VOID *) (UINTN) BufferPtr
> +                       );
> +    }
>      break;
> 
>    case PXE_IO_WRITE:
> -    Snp->PciIo->Io.Write (
> -                     Snp->PciIo,
> -                     Width,
> -                     Snp->IoBarIndex,      // BAR 1 (for 32bit regs), IO base address
> -                     MemOrPortAddr,
> -                     1,                    // count
> -                     (VOID *) (UINTN) BufferPtr
> -                     );
> +    ASSERT (Snp->IoBarIndex < PCI_MAX_BAR);
> +    if (Snp->IoBarIndex < PCI_MAX_BAR) {
> +      Snp->PciIo->Io.Write (
> +                       Snp->PciIo,
> +                       Width,
> +                       Snp->IoBarIndex,      // BAR 1 (for 32bit regs), IO base address
> +                       MemOrPortAddr,
> +                       1,                    // count
> +                       (VOID *) (UINTN) BufferPtr
> +                       );
> +    }
>      break;
> 
>    case PXE_MEM_READ:
> -    Snp->PciIo->Mem.Read (
> -                      Snp->PciIo,
> -                      Width,
> -                      Snp->MemoryBarIndex,  // BAR 0, Memory base address
> -                      MemOrPortAddr,
> -                      1,                    // count
> -                      (VOID *) (UINTN) BufferPtr
> -                      );
> +    ASSERT (Snp->MemoryBarIndex < PCI_MAX_BAR);
> +    if (Snp->MemoryBarIndex < PCI_MAX_BAR) {
> +      Snp->PciIo->Mem.Read (
> +                        Snp->PciIo,
> +                        Width,
> +                        Snp->MemoryBarIndex,  // BAR 0, Memory base address
> +                        MemOrPortAddr,
> +                        1,                    // count
> +                        (VOID *) (UINTN) BufferPtr
> +                        );
> +    }
>      break;
> 
>    case PXE_MEM_WRITE:
> -    Snp->PciIo->Mem.Write (
> -                      Snp->PciIo,
> -                      Width,
> -                      Snp->MemoryBarIndex,  // BAR 0, Memory base address
> -                      MemOrPortAddr,
> -                      1,                    // count
> -                      (VOID *) (UINTN) BufferPtr
> -                      );
> +    ASSERT (Snp->MemoryBarIndex < PCI_MAX_BAR);
> +    if (Snp->MemoryBarIndex < PCI_MAX_BAR) {
> +      Snp->PciIo->Mem.Write (
> +                        Snp->PciIo,
> +                        Width,
> +                        Snp->MemoryBarIndex,  // BAR 0, Memory base address
> +                        MemOrPortAddr,
> +                        1,                    // count
> +                        (VOID *) (UINTN) BufferPtr
> +                        );
> +    }
>      break;
>    }
> 
> diff --git a/NetworkPkg/SnpDxe/Snp.c b/NetworkPkg/SnpDxe/Snp.c
> index 078b27cf5edd..da9fba51eff5 100644
> --- a/NetworkPkg/SnpDxe/Snp.c
> +++ b/NetworkPkg/SnpDxe/Snp.c
> @@ -2,6 +2,7 @@
>    Implementation of driver entry point and driver binding protocol.
> 
>  Copyright (c) 2004 - 2019, Intel Corporation. All rights reserved.<BR>
> +Copyright (c) Microsoft Corporation.<BR>
>  SPDX-License-Identifier: BSD-2-Clause-Patent
> 
>  **/
> @@ -465,8 +466,8 @@ SimpleNetworkDriverStart (
>    // the IO BAR.  Save the index of the BAR into the adapter info structure.
>    // for regular 32bit BARs, 0 is memory mapped, 1 is io mapped
>    //
> -  Snp->MemoryBarIndex = 0;
> -  Snp->IoBarIndex     = 1;
> +  Snp->MemoryBarIndex = PCI_MAX_BAR;
> +  Snp->IoBarIndex     = PCI_MAX_BAR;
>    FoundMemoryBar      = FALSE;
>    FoundIoBar          = FALSE;
>    for (BarIndex = 0; BarIndex < PCI_MAX_BAR; BarIndex++) {
> --
> 2.16.3.windows.1
> 
> 
> 


  reply	other threads:[~2020-04-17  2:51 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-04-09  3:02 [PATCH v1 1/1] NetworkPkg/SnpDxe: Prevent invalid PCI BAR access Michael Kubacki
2020-04-17  2:51 ` Siyuan, Fu [this message]
2020-04-17 15:48   ` [edk2-devel] " Maciej Rabeda

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=B1FF2E9001CE9041BD10B825821D5BC58B9F86FD@SHSMSX103.ccr.corp.intel.com \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox