Currently, the MSI table offset supplied by device's config space is passed directly into ioremap() without validation, allowing, for example, a malicious VMM to trick the OS into exposing its private memory.

Correct this by making sure the table with the given number of vectors fits into its BIR starting at the provided table offset.

Signed-off-by: Alexander Shishkin alexander.shishkin@linux.intel.com Reported-by: Elena Reshetova elena.reshetova@intel.com Reviewed-by: Mika Westerberg mika.westerberg@linux.intel.com Reviewed-by: Ilpo Järvinen ilpo.jarvinen@linux.intel.com Cc: stable@vger.kernel.org --- drivers/pci/msi/msi.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c index d50cd45119f1..e93e633cb6a3 100644 --- a/drivers/pci/msi/msi.c +++ b/drivers/pci/msi/msi.c @@ -552,7 +552,8 @@ static void __iomem *msix_map_region(struct pci_dev *dev, unsigned int nr_entries) { resource_size_t phys_addr; - u32 table_offset; + u32 table_offset, table_size; + resource_size_t bir_size; unsigned long flags; u8 bir;

@@ -563,10 +564,15 @@ static void __iomem *msix_map_region(struct pci_dev *dev, if (!flags || (flags & IORESOURCE_UNSET)) return NULL;

+ bir_size = pci_resource_len(dev, bir); + table_size = nr_entries * PCI_MSIX_ENTRY_SIZE; table_offset &= PCI_MSIX_TABLE_OFFSET; + if (bir_size < table_size || table_offset > bir_size - table_size) + return NULL; + phys_addr = pci_resource_start(dev, bir) + table_offset;

- return ioremap(phys_addr, nr_entries * PCI_MSIX_ENTRY_SIZE); + return ioremap(phys_addr, table_size); }

/**