Patchwork [v4,1/3] PCI: dwc: allow to limit registers set length

login
register
mail settings
Submitter Stefan Agner
Date Dec. 4, 2018, 4:55 p.m.
Message ID <20181204165528.15534-1-stefan@agner.ch>
Download mbox | patch
Permalink /patch/672207/
State New
Headers show

Comments

Stefan Agner - Dec. 4, 2018, 4:55 p.m.
Add length to the struct dw_pcie and check that the accessors
dw_pcie_(rd|wr)_conf() do not read/write beyond that point.

Suggested-by: Trent Piepho <tpiepho@impinj.com>
Signed-off-by: Stefan Agner <stefan@agner.ch>
---
Changes in v4:
- Move length check to dw_pcie_rd_conf

 .../pci/controller/dwc/pcie-designware-host.c    | 16 ++++++++++++++--
 drivers/pci/controller/dwc/pcie-designware.h     |  1 +
 2 files changed, 15 insertions(+), 2 deletions(-)
Lorenzo Pieralisi - Jan. 30, 2019, 5:54 p.m.
On Tue, Dec 04, 2018 at 05:55:26PM +0100, Stefan Agner wrote:
> Add length to the struct dw_pcie and check that the accessors
> dw_pcie_(rd|wr)_conf() do not read/write beyond that point.
> 
> Suggested-by: Trent Piepho <tpiepho@impinj.com>
> Signed-off-by: Stefan Agner <stefan@agner.ch>
> ---
> Changes in v4:
> - Move length check to dw_pcie_rd_conf
> 
>  .../pci/controller/dwc/pcie-designware-host.c    | 16 ++++++++++++++--
>  drivers/pci/controller/dwc/pcie-designware.h     |  1 +
>  2 files changed, 15 insertions(+), 2 deletions(-)

Hi Stefan,

I wanted to ask you if this series should be considered for v5.1
inclusion, it is in the PCI backlog. If it is, let me have a look
and if it is OK to go I will likely ask you to rebase it.

Thanks,
Lorenzo

> diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
> index 692dd1b264fb..9fc0f7bd99f0 100644
> --- a/drivers/pci/controller/dwc/pcie-designware-host.c
> +++ b/drivers/pci/controller/dwc/pcie-designware-host.c
> @@ -606,14 +606,20 @@ static int dw_pcie_rd_conf(struct pci_bus *bus, u32 devfn, int where,
>  			   int size, u32 *val)
>  {
>  	struct pcie_port *pp = bus->sysdata;
> +	struct dw_pcie *pci;
>  
>  	if (!dw_pcie_valid_device(pp, bus, PCI_SLOT(devfn))) {
>  		*val = 0xffffffff;
>  		return PCIBIOS_DEVICE_NOT_FOUND;
>  	}
>  
> -	if (bus->number == pp->root_bus_nr)
> +	if (bus->number == pp->root_bus_nr) {
> +		pci = to_dw_pcie_from_pp(pp);
> +		if (pci->dbi_length && where + size > pci->dbi_length)
> +			return PCIBIOS_BAD_REGISTER_NUMBER;
> +
>  		return dw_pcie_rd_own_conf(pp, where, size, val);
> +	}
>  
>  	return dw_pcie_rd_other_conf(pp, bus, devfn, where, size, val);
>  }
> @@ -622,12 +628,18 @@ static int dw_pcie_wr_conf(struct pci_bus *bus, u32 devfn,
>  			   int where, int size, u32 val)
>  {
>  	struct pcie_port *pp = bus->sysdata;
> +	struct dw_pcie *pci;
>  
>  	if (!dw_pcie_valid_device(pp, bus, PCI_SLOT(devfn)))
>  		return PCIBIOS_DEVICE_NOT_FOUND;
>  
> -	if (bus->number == pp->root_bus_nr)
> +	if (bus->number == pp->root_bus_nr) {
> +		pci = to_dw_pcie_from_pp(pp);
> +		if (pci->dbi_length && where + size > pci->dbi_length)
> +			return PCIBIOS_BAD_REGISTER_NUMBER;
> +
>  		return dw_pcie_wr_own_conf(pp, where, size, val);
> +	}
>  
>  	return dw_pcie_wr_other_conf(pp, bus, devfn, where, size, val);
>  }
> diff --git a/drivers/pci/controller/dwc/pcie-designware.h b/drivers/pci/controller/dwc/pcie-designware.h
> index 9943d8c68335..9cd7bdc94200 100644
> --- a/drivers/pci/controller/dwc/pcie-designware.h
> +++ b/drivers/pci/controller/dwc/pcie-designware.h
> @@ -229,6 +229,7 @@ struct dw_pcie {
>  	void __iomem		*dbi_base2;
>  	/* Used when iatu_unroll_enabled is true */
>  	void __iomem		*atu_base;
> +	int			dbi_length;
>  	u32			num_viewport;
>  	u8			iatu_unroll_enabled;
>  	struct pcie_port	pp;
> -- 
> 2.19.1
>
Stefan Agner - Jan. 31, 2019, 9:08 a.m.
On 30.01.2019 18:54, Lorenzo Pieralisi wrote:
> On Tue, Dec 04, 2018 at 05:55:26PM +0100, Stefan Agner wrote:
>> Add length to the struct dw_pcie and check that the accessors
>> dw_pcie_(rd|wr)_conf() do not read/write beyond that point.
>>
>> Suggested-by: Trent Piepho <tpiepho@impinj.com>
>> Signed-off-by: Stefan Agner <stefan@agner.ch>
>> ---
>> Changes in v4:
>> - Move length check to dw_pcie_rd_conf
>>
>>  .../pci/controller/dwc/pcie-designware-host.c    | 16 ++++++++++++++--
>>  drivers/pci/controller/dwc/pcie-designware.h     |  1 +
>>  2 files changed, 15 insertions(+), 2 deletions(-)
> 
> Hi Stefan,
> 
> I wanted to ask you if this series should be considered for v5.1
> inclusion, it is in the PCI backlog. If it is, let me have a look
> and if it is OK to go I will likely ask you to rebase it.

Yes please. With this last change I did not see any regression anymore
so far.

Andrey Smirnov picked up the second patch: "PCI: imx6: introduce
drvdata". Not sure what the plan is with his patchset, if it gets merged
into v5.1 too then I probably better drop this patch and rebase ontop of
his series.

--
Stefan

> 
> Thanks,
> Lorenzo
> 
>> diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
>> index 692dd1b264fb..9fc0f7bd99f0 100644
>> --- a/drivers/pci/controller/dwc/pcie-designware-host.c
>> +++ b/drivers/pci/controller/dwc/pcie-designware-host.c
>> @@ -606,14 +606,20 @@ static int dw_pcie_rd_conf(struct pci_bus *bus, u32 devfn, int where,
>>  			   int size, u32 *val)
>>  {
>>  	struct pcie_port *pp = bus->sysdata;
>> +	struct dw_pcie *pci;
>>
>>  	if (!dw_pcie_valid_device(pp, bus, PCI_SLOT(devfn))) {
>>  		*val = 0xffffffff;
>>  		return PCIBIOS_DEVICE_NOT_FOUND;
>>  	}
>>
>> -	if (bus->number == pp->root_bus_nr)
>> +	if (bus->number == pp->root_bus_nr) {
>> +		pci = to_dw_pcie_from_pp(pp);
>> +		if (pci->dbi_length && where + size > pci->dbi_length)
>> +			return PCIBIOS_BAD_REGISTER_NUMBER;
>> +
>>  		return dw_pcie_rd_own_conf(pp, where, size, val);
>> +	}
>>
>>  	return dw_pcie_rd_other_conf(pp, bus, devfn, where, size, val);
>>  }
>> @@ -622,12 +628,18 @@ static int dw_pcie_wr_conf(struct pci_bus *bus, u32 devfn,
>>  			   int where, int size, u32 val)
>>  {
>>  	struct pcie_port *pp = bus->sysdata;
>> +	struct dw_pcie *pci;
>>
>>  	if (!dw_pcie_valid_device(pp, bus, PCI_SLOT(devfn)))
>>  		return PCIBIOS_DEVICE_NOT_FOUND;
>>
>> -	if (bus->number == pp->root_bus_nr)
>> +	if (bus->number == pp->root_bus_nr) {
>> +		pci = to_dw_pcie_from_pp(pp);
>> +		if (pci->dbi_length && where + size > pci->dbi_length)
>> +			return PCIBIOS_BAD_REGISTER_NUMBER;
>> +
>>  		return dw_pcie_wr_own_conf(pp, where, size, val);
>> +	}
>>
>>  	return dw_pcie_wr_other_conf(pp, bus, devfn, where, size, val);
>>  }
>> diff --git a/drivers/pci/controller/dwc/pcie-designware.h b/drivers/pci/controller/dwc/pcie-designware.h
>> index 9943d8c68335..9cd7bdc94200 100644
>> --- a/drivers/pci/controller/dwc/pcie-designware.h
>> +++ b/drivers/pci/controller/dwc/pcie-designware.h
>> @@ -229,6 +229,7 @@ struct dw_pcie {
>>  	void __iomem		*dbi_base2;
>>  	/* Used when iatu_unroll_enabled is true */
>>  	void __iomem		*atu_base;
>> +	int			dbi_length;
>>  	u32			num_viewport;
>>  	u8			iatu_unroll_enabled;
>>  	struct pcie_port	pp;
>> --
>> 2.19.1
>>
Lorenzo Pieralisi - Feb. 1, 2019, 5:13 p.m.
On Thu, Jan 31, 2019 at 10:08:11AM +0100, Stefan Agner wrote:
> On 30.01.2019 18:54, Lorenzo Pieralisi wrote:
> > On Tue, Dec 04, 2018 at 05:55:26PM +0100, Stefan Agner wrote:
> >> Add length to the struct dw_pcie and check that the accessors
> >> dw_pcie_(rd|wr)_conf() do not read/write beyond that point.
> >>
> >> Suggested-by: Trent Piepho <tpiepho@impinj.com>
> >> Signed-off-by: Stefan Agner <stefan@agner.ch>
> >> ---
> >> Changes in v4:
> >> - Move length check to dw_pcie_rd_conf
> >>
> >>  .../pci/controller/dwc/pcie-designware-host.c    | 16 ++++++++++++++--
> >>  drivers/pci/controller/dwc/pcie-designware.h     |  1 +
> >>  2 files changed, 15 insertions(+), 2 deletions(-)
> > 
> > Hi Stefan,
> > 
> > I wanted to ask you if this series should be considered for v5.1
> > inclusion, it is in the PCI backlog. If it is, let me have a look
> > and if it is OK to go I will likely ask you to rebase it.
> 
> Yes please. With this last change I did not see any regression anymore
> so far.
> 
> Andrey Smirnov picked up the second patch: "PCI: imx6: introduce
> drvdata". Not sure what the plan is with his patchset, if it gets merged
> into v5.1 too then I probably better drop this patch and rebase ontop of
> his series.

Ok, I will get back to you when I merged Andrey's series so that you
can rebase on top of my pci/dwc branch with Andrey's patches applied.

Lorenzo
Lorenzo Pieralisi - Feb. 4, 2019, 12:27 p.m.
On Thu, Jan 31, 2019 at 10:08:11AM +0100, Stefan Agner wrote:
> On 30.01.2019 18:54, Lorenzo Pieralisi wrote:
> > On Tue, Dec 04, 2018 at 05:55:26PM +0100, Stefan Agner wrote:
> >> Add length to the struct dw_pcie and check that the accessors
> >> dw_pcie_(rd|wr)_conf() do not read/write beyond that point.
> >>
> >> Suggested-by: Trent Piepho <tpiepho@impinj.com>
> >> Signed-off-by: Stefan Agner <stefan@agner.ch>
> >> ---
> >> Changes in v4:
> >> - Move length check to dw_pcie_rd_conf
> >>
> >>  .../pci/controller/dwc/pcie-designware-host.c    | 16 ++++++++++++++--
> >>  drivers/pci/controller/dwc/pcie-designware.h     |  1 +
> >>  2 files changed, 15 insertions(+), 2 deletions(-)
> > 
> > Hi Stefan,
> > 
> > I wanted to ask you if this series should be considered for v5.1
> > inclusion, it is in the PCI backlog. If it is, let me have a look
> > and if it is OK to go I will likely ask you to rebase it.
> 
> Yes please. With this last change I did not see any regression anymore
> so far.
> 
> Andrey Smirnov picked up the second patch: "PCI: imx6: introduce
> drvdata". Not sure what the plan is with his patchset, if it gets merged
> into v5.1 too then I probably better drop this patch and rebase ontop of
> his series.

You can now rebase it on top of my pci/dwc branch and send a v5, I
will mark this series as superseded in the PCI patch queue.

Lorenzo

> Stefan
> 
> > 
> > Thanks,
> > Lorenzo
> > 
> >> diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
> >> index 692dd1b264fb..9fc0f7bd99f0 100644
> >> --- a/drivers/pci/controller/dwc/pcie-designware-host.c
> >> +++ b/drivers/pci/controller/dwc/pcie-designware-host.c
> >> @@ -606,14 +606,20 @@ static int dw_pcie_rd_conf(struct pci_bus *bus, u32 devfn, int where,
> >>  			   int size, u32 *val)
> >>  {
> >>  	struct pcie_port *pp = bus->sysdata;
> >> +	struct dw_pcie *pci;
> >>
> >>  	if (!dw_pcie_valid_device(pp, bus, PCI_SLOT(devfn))) {
> >>  		*val = 0xffffffff;
> >>  		return PCIBIOS_DEVICE_NOT_FOUND;
> >>  	}
> >>
> >> -	if (bus->number == pp->root_bus_nr)
> >> +	if (bus->number == pp->root_bus_nr) {
> >> +		pci = to_dw_pcie_from_pp(pp);
> >> +		if (pci->dbi_length && where + size > pci->dbi_length)
> >> +			return PCIBIOS_BAD_REGISTER_NUMBER;
> >> +
> >>  		return dw_pcie_rd_own_conf(pp, where, size, val);
> >> +	}
> >>
> >>  	return dw_pcie_rd_other_conf(pp, bus, devfn, where, size, val);
> >>  }
> >> @@ -622,12 +628,18 @@ static int dw_pcie_wr_conf(struct pci_bus *bus, u32 devfn,
> >>  			   int where, int size, u32 val)
> >>  {
> >>  	struct pcie_port *pp = bus->sysdata;
> >> +	struct dw_pcie *pci;
> >>
> >>  	if (!dw_pcie_valid_device(pp, bus, PCI_SLOT(devfn)))
> >>  		return PCIBIOS_DEVICE_NOT_FOUND;
> >>
> >> -	if (bus->number == pp->root_bus_nr)
> >> +	if (bus->number == pp->root_bus_nr) {
> >> +		pci = to_dw_pcie_from_pp(pp);
> >> +		if (pci->dbi_length && where + size > pci->dbi_length)
> >> +			return PCIBIOS_BAD_REGISTER_NUMBER;
> >> +
> >>  		return dw_pcie_wr_own_conf(pp, where, size, val);
> >> +	}
> >>
> >>  	return dw_pcie_wr_other_conf(pp, bus, devfn, where, size, val);
> >>  }
> >> diff --git a/drivers/pci/controller/dwc/pcie-designware.h b/drivers/pci/controller/dwc/pcie-designware.h
> >> index 9943d8c68335..9cd7bdc94200 100644
> >> --- a/drivers/pci/controller/dwc/pcie-designware.h
> >> +++ b/drivers/pci/controller/dwc/pcie-designware.h
> >> @@ -229,6 +229,7 @@ struct dw_pcie {
> >>  	void __iomem		*dbi_base2;
> >>  	/* Used when iatu_unroll_enabled is true */
> >>  	void __iomem		*atu_base;
> >> +	int			dbi_length;
> >>  	u32			num_viewport;
> >>  	u8			iatu_unroll_enabled;
> >>  	struct pcie_port	pp;
> >> --
> >> 2.19.1
> >>

Patch

diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
index 692dd1b264fb..9fc0f7bd99f0 100644
--- a/drivers/pci/controller/dwc/pcie-designware-host.c
+++ b/drivers/pci/controller/dwc/pcie-designware-host.c
@@ -606,14 +606,20 @@  static int dw_pcie_rd_conf(struct pci_bus *bus, u32 devfn, int where,
 			   int size, u32 *val)
 {
 	struct pcie_port *pp = bus->sysdata;
+	struct dw_pcie *pci;
 
 	if (!dw_pcie_valid_device(pp, bus, PCI_SLOT(devfn))) {
 		*val = 0xffffffff;
 		return PCIBIOS_DEVICE_NOT_FOUND;
 	}
 
-	if (bus->number == pp->root_bus_nr)
+	if (bus->number == pp->root_bus_nr) {
+		pci = to_dw_pcie_from_pp(pp);
+		if (pci->dbi_length && where + size > pci->dbi_length)
+			return PCIBIOS_BAD_REGISTER_NUMBER;
+
 		return dw_pcie_rd_own_conf(pp, where, size, val);
+	}
 
 	return dw_pcie_rd_other_conf(pp, bus, devfn, where, size, val);
 }
@@ -622,12 +628,18 @@  static int dw_pcie_wr_conf(struct pci_bus *bus, u32 devfn,
 			   int where, int size, u32 val)
 {
 	struct pcie_port *pp = bus->sysdata;
+	struct dw_pcie *pci;
 
 	if (!dw_pcie_valid_device(pp, bus, PCI_SLOT(devfn)))
 		return PCIBIOS_DEVICE_NOT_FOUND;
 
-	if (bus->number == pp->root_bus_nr)
+	if (bus->number == pp->root_bus_nr) {
+		pci = to_dw_pcie_from_pp(pp);
+		if (pci->dbi_length && where + size > pci->dbi_length)
+			return PCIBIOS_BAD_REGISTER_NUMBER;
+
 		return dw_pcie_wr_own_conf(pp, where, size, val);
+	}
 
 	return dw_pcie_wr_other_conf(pp, bus, devfn, where, size, val);
 }
diff --git a/drivers/pci/controller/dwc/pcie-designware.h b/drivers/pci/controller/dwc/pcie-designware.h
index 9943d8c68335..9cd7bdc94200 100644
--- a/drivers/pci/controller/dwc/pcie-designware.h
+++ b/drivers/pci/controller/dwc/pcie-designware.h
@@ -229,6 +229,7 @@  struct dw_pcie {
 	void __iomem		*dbi_base2;
 	/* Used when iatu_unroll_enabled is true */
 	void __iomem		*atu_base;
+	int			dbi_length;
 	u32			num_viewport;
 	u8			iatu_unroll_enabled;
 	struct pcie_port	pp;