linux-kernel - [PATCH v2] x86:sysfb_efi:efifb_set_system: fix miss valid address range in later BARs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Sun, 1 May 2016 00:21:05 +0800
From:	Wang YanQing <udknight@...il.com>
To:	x86@...nel.org
Cc:	hpa@...or.com, tglx@...utronix.de, mingo@...hat.com,
	pjones@...hat.com, dh.herrmann@...il.com, tomi.valkeinen@...com,
	linux-kernel@...r.kernel.org
Subject: [PATCH v2] x86:sysfb_efi:efifb_set_system: fix miss valid address
 range in later BARs

We can't just break out when meet start is equal to zero,
this will cause we miss valid address range in later BARs.

On the other hand, it isn't enough to test start only
for below situation:
0(start) <= lfb_base < end

Note: this patch also add a trivial optimization,
      break out after we find the address range
      is valid without test later BARs.

Signed-off-by: Wang YanQing <udknight@...il.com>
---
 Due to the BUG this patch fix, I can't use video=efifb:
 boot parameter to get efifb on my new ThinkPad E550 for
 my old linux system hard disk with 3.10 kernel. In 3.10, 
 efifb is the only choice due to DRM/I915 in it doesn't 
 support the GPU.

 Changes:
 v1-v2:
 1: Do a trivial code optimization.

 arch/x86/kernel/sysfb_efi.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/sysfb_efi.c b/arch/x86/kernel/sysfb_efi.c
index b285d4e..5da924b 100644
--- a/arch/x86/kernel/sysfb_efi.c
+++ b/arch/x86/kernel/sysfb_efi.c
@@ -106,14 +106,24 @@ static int __init efifb_set_system(const struct dmi_system_id *id)
 					continue;
 				for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
 					resource_size_t start, end;
+					unsigned long flags;
+
+					flags = pci_resource_flags(dev, i);
+					if (!(flags & IORESOURCE_MEM))
+						continue;
+
+					if (flags & IORESOURCE_UNSET)
+						continue;
+
+					if (pci_resource_len(dev, i) == 0)
+						continue;
 
 					start = pci_resource_start(dev, i);
-					if (start == 0)
-						break;
 					end = pci_resource_end(dev, i);
 					if (screen_info.lfb_base >= start &&
 					    screen_info.lfb_base < end) {
 						found_bar = 1;
+						break;
 					}
 				}
 			}
-- 
1.8.5.6.2.g3d8a54e.dirty