61 lines
2.2 KiB
Diff
61 lines
2.2 KiB
Diff
From 193240c79f5c95aaf86b2998975189f1873ebcec Mon Sep 17 00:00:00 2001
|
|
From: tangzhongrui <tangzhongrui@cmss.chinamobile.com>
|
|
Date: Fri, 18 Aug 2023 14:41:45 +0800
|
|
Subject: [PATCH] hw/vfio/pci-quirks: Sanitize capability pointer Coverity
|
|
reports a tained scalar when traversing the capabilities chain (CID 1516589).
|
|
In practice I've never seen a device with a chain so broken as to cause an
|
|
issue, but it's also pretty easy to sanitize.
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
Fixes: f6b30c1 ("hw/vfio/pci-quirks: Support alternate offset for
|
|
GPUDirect Cliques")
|
|
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
|
|
Reviewed-by: Cédric Le Goater <clg@redhat.com>
|
|
Signed-off-by: Cédric Le Goater <clg@redhat.com>
|
|
|
|
Signed-off-by: Zhongrui Tang <tangzhongrui_yewu@cmss.chinamobile.com>
|
|
---
|
|
hw/vfio/pci-quirks.c | 10 ++++++++--
|
|
1 file changed, 8 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/hw/vfio/pci-quirks.c b/hw/vfio/pci-quirks.c
|
|
index 7a8e6efcdc..a911e04a79 100644
|
|
--- a/hw/vfio/pci-quirks.c
|
|
+++ b/hw/vfio/pci-quirks.c
|
|
@@ -1717,6 +1717,12 @@ const PropertyInfo qdev_prop_nv_gpudirect_clique = {
|
|
.set = set_nv_gpudirect_clique_id,
|
|
};
|
|
|
|
+static bool is_valid_std_cap_offset(uint8_t pos)
|
|
+{
|
|
+ return (pos >= PCI_STD_HEADER_SIZEOF &&
|
|
+ pos <= (PCI_CFG_SPACE_SIZE - PCI_CAP_SIZEOF));
|
|
+}
|
|
+
|
|
static int vfio_add_nv_gpudirect_cap(VFIOPCIDevice *vdev, Error **errp)
|
|
{
|
|
PCIDevice *pdev = &vdev->pdev;
|
|
@@ -1750,7 +1756,7 @@ static int vfio_add_nv_gpudirect_cap(VFIOPCIDevice *vdev, Error **errp)
|
|
*/
|
|
ret = pread(vdev->vbasedev.fd, &tmp, 1,
|
|
vdev->config_offset + PCI_CAPABILITY_LIST);
|
|
- if (ret != 1 || !tmp) {
|
|
+ if (ret != 1 || !is_valid_std_cap_offset(tmp)) {
|
|
error_setg(errp, "NVIDIA GPUDirect Clique ID: error getting cap list");
|
|
return -EINVAL;
|
|
}
|
|
@@ -1762,7 +1768,7 @@ static int vfio_add_nv_gpudirect_cap(VFIOPCIDevice *vdev, Error **errp)
|
|
d4_conflict = true;
|
|
}
|
|
tmp = pdev->config[tmp + PCI_CAP_LIST_NEXT];
|
|
- } while (tmp);
|
|
+ } while (is_valid_std_cap_offset(tmp));
|
|
|
|
if (!c8_conflict) {
|
|
pos = 0xC8;
|
|
--
|
|
2.41.0.windows.1
|
|
|