linux-kernel - [PATCH 8/14 v3] PCI/ACPI: Check the return value of pcie_capability_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 13 Jul 2020 19:55:28 +0200
From:   "Saheed O. Bolarinwa" <refactormyself@...il.com>
To:     skhan@...uxfoundation.org, linux-acpi@...r.kernel.org,
        linux-pci@...r.kernel.org,
        linux-kernel-mentees@...ts.linuxfoundation.org,
        linux-kernel@...r.kernel.org
Cc:     Bolarinwa Olayemi Saheed <refactormyself@...il.com>
Subject: [PATCH 8/14 v3] PCI/ACPI: Check the return value of pcie_capability_read_*()

From: Bolarinwa Olayemi Saheed <refactormyself@...il.com>

On failure pcie_capability_read_dword() sets it's last parameter,
val to 0.
However, with Patch 14/14, it is possible that val is set to ~0 on
failure. This would introduce a bug because (x & x) == (~0 & x). 

This bug can be avoided if the return value of pcie_capability_read_word
is checked to confirm success.

Check the return value of pcie_capability_read_word() to ensure success.

Suggested-by: Bjorn Helgaas <bjorn@...gaas.com>
Signed-off-by: Bolarinwa Olayemi Saheed <refactormyself@...il.com>
---
 drivers/pci/pci-acpi.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index 7224b1e5f2a8..39eb816bc3b8 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -248,12 +248,13 @@ static bool pcie_root_rcb_set(struct pci_dev *dev)
 {
 	struct pci_dev *rp = pcie_find_root_port(dev);
 	u16 lnkctl;
+	int ret;
 
 	if (!rp)
 		return false;
 
-	pcie_capability_read_word(rp, PCI_EXP_LNKCTL, &lnkctl);
-	if (lnkctl & PCI_EXP_LNKCTL_RCB)
+	ret = pcie_capability_read_word(rp, PCI_EXP_LNKCTL, &lnkctl);
+	if (!ret && (lnkctl & PCI_EXP_LNKCTL_RCB))
 		return true;
 
 	return false;
@@ -792,12 +793,13 @@ bool pciehp_is_native(struct pci_dev *bridge)
 {
 	const struct pci_host_bridge *host;
 	u32 slot_cap;
+	int ret;
 
 	if (!IS_ENABLED(CONFIG_HOTPLUG_PCI_PCIE))
 		return false;
 
-	pcie_capability_read_dword(bridge, PCI_EXP_SLTCAP, &slot_cap);
-	if (!(slot_cap & PCI_EXP_SLTCAP_HPC))
+	ret = pcie_capability_read_dword(bridge, PCI_EXP_SLTCAP, &slot_cap);
+	if (ret || !(slot_cap & PCI_EXP_SLTCAP_HPC))
 		return false;
 
 	if (pcie_ports_native)
-- 
2.18.2