[PATCH v1 1/1] NetworkPkg/SnpDxe: Prevent invalid PCI BAR access

["Michael Kubacki" <michael.kubacki@outlook.com>]

From: Michael Kubacki <michael.kubacki@microsoft.com>

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1563

SnpDxe initializes values for MemoryBarIndex and IoBarIndex to 0 and 1
respectively even if calls to PciIo->GetBarAttributes never return
success.

Later, if the BAR is used to perform IO/Mem reads/writes, a potentially
non-existent BAR index may be accessed. This change initializes the values
to an invalid BAR index (PCI_MAX_BAR) so the condition can be explicitly
checked to avoid an invalid BAR access.

Cc: Siyuan Fu <siyuan.fu@intel.com>
Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>
Cc: Jiaxin Wu <jiaxin.wu@intel.com>
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
---
 NetworkPkg/SnpDxe/Callback.c | 77 ++++++++++++--------
 NetworkPkg/SnpDxe/Snp.c      |  5 +-
 2 files changed, 48 insertions(+), 34 deletions(-)

diff --git a/NetworkPkg/SnpDxe/Callback.c b/NetworkPkg/SnpDxe/Callback.c
index 0c0b81fdca8e..99b7fd3ef835 100644
--- a/NetworkPkg/SnpDxe/Callback.c
+++ b/NetworkPkg/SnpDxe/Callback.c
@@ -4,6 +4,7 @@
   stores the interface context for the NIC that snp is trying to talk.
 
 Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>
+Copyright (c) Microsoft Corporation.<BR>
 SPDX-License-Identifier: BSD-2-Clause-Patent
 
 **/
@@ -115,47 +116,59 @@ SnpUndi32CallbackMemio (
 
   switch (ReadOrWrite) {
   case PXE_IO_READ:
-    Snp->PciIo->Io.Read (
-                     Snp->PciIo,
-                     Width,
-                     Snp->IoBarIndex,      // BAR 1 (for 32bit regs), IO base address
-                     MemOrPortAddr,
-                     1,                    // count
-                     (VOID *) (UINTN) BufferPtr
-                     );
+    ASSERT (Snp->IoBarIndex < PCI_MAX_BAR);
+    if (Snp->IoBarIndex < PCI_MAX_BAR) {
+      Snp->PciIo->Io.Read (
+                       Snp->PciIo,
+                       Width,
+                       Snp->IoBarIndex,      // BAR 1 (for 32bit regs), IO base address
+                       MemOrPortAddr,
+                       1,                    // count
+                       (VOID *) (UINTN) BufferPtr
+                       );
+    }
     break;
 
   case PXE_IO_WRITE:
-    Snp->PciIo->Io.Write (
-                     Snp->PciIo,
-                     Width,
-                     Snp->IoBarIndex,      // BAR 1 (for 32bit regs), IO base address
-                     MemOrPortAddr,
-                     1,                    // count
-                     (VOID *) (UINTN) BufferPtr
-                     );
+    ASSERT (Snp->IoBarIndex < PCI_MAX_BAR);
+    if (Snp->IoBarIndex < PCI_MAX_BAR) {
+      Snp->PciIo->Io.Write (
+                       Snp->PciIo,
+                       Width,
+                       Snp->IoBarIndex,      // BAR 1 (for 32bit regs), IO base address
+                       MemOrPortAddr,
+                       1,                    // count
+                       (VOID *) (UINTN) BufferPtr
+                       );
+    }
     break;
 
   case PXE_MEM_READ:
-    Snp->PciIo->Mem.Read (
-                      Snp->PciIo,
-                      Width,
-                      Snp->MemoryBarIndex,  // BAR 0, Memory base address
-                      MemOrPortAddr,
-                      1,                    // count
-                      (VOID *) (UINTN) BufferPtr
-                      );
+    ASSERT (Snp->MemoryBarIndex < PCI_MAX_BAR);
+    if (Snp->MemoryBarIndex < PCI_MAX_BAR) {
+      Snp->PciIo->Mem.Read (
+                        Snp->PciIo,
+                        Width,
+                        Snp->MemoryBarIndex,  // BAR 0, Memory base address
+                        MemOrPortAddr,
+                        1,                    // count
+                        (VOID *) (UINTN) BufferPtr
+                        );
+    }
     break;
 
   case PXE_MEM_WRITE:
-    Snp->PciIo->Mem.Write (
-                      Snp->PciIo,
-                      Width,
-                      Snp->MemoryBarIndex,  // BAR 0, Memory base address
-                      MemOrPortAddr,
-                      1,                    // count
-                      (VOID *) (UINTN) BufferPtr
-                      );
+    ASSERT (Snp->MemoryBarIndex < PCI_MAX_BAR);
+    if (Snp->MemoryBarIndex < PCI_MAX_BAR) {
+      Snp->PciIo->Mem.Write (
+                        Snp->PciIo,
+                        Width,
+                        Snp->MemoryBarIndex,  // BAR 0, Memory base address
+                        MemOrPortAddr,
+                        1,                    // count
+                        (VOID *) (UINTN) BufferPtr
+                        );
+    }
     break;
   }
 
diff --git a/NetworkPkg/SnpDxe/Snp.c b/NetworkPkg/SnpDxe/Snp.c
index 078b27cf5edd..da9fba51eff5 100644
--- a/NetworkPkg/SnpDxe/Snp.c
+++ b/NetworkPkg/SnpDxe/Snp.c
@@ -2,6 +2,7 @@
   Implementation of driver entry point and driver binding protocol.
 
 Copyright (c) 2004 - 2019, Intel Corporation. All rights reserved.<BR>
+Copyright (c) Microsoft Corporation.<BR>
 SPDX-License-Identifier: BSD-2-Clause-Patent
 
 **/
@@ -465,8 +466,8 @@ SimpleNetworkDriverStart (
   // the IO BAR.  Save the index of the BAR into the adapter info structure.
   // for regular 32bit BARs, 0 is memory mapped, 1 is io mapped
   //
-  Snp->MemoryBarIndex = 0;
-  Snp->IoBarIndex     = 1;
+  Snp->MemoryBarIndex = PCI_MAX_BAR;
+  Snp->IoBarIndex     = PCI_MAX_BAR;
   FoundMemoryBar      = FALSE;
   FoundIoBar          = FALSE;
   for (BarIndex = 0; BarIndex < PCI_MAX_BAR; BarIndex++) {
-- 
2.16.3.windows.1