sysadmin/ipxe
1
0
Fork 0
mirror of https://github.com/ipxe/ipxe synced 2026-02-06 13:19:28 +03:00
Code Issues Packages Projects Releases Wiki Activity

[pci] Check for wraparound in callers of pci_find_next()

Browse Source 
The semantics of the bus:dev.fn parameter passed to pci_find_next()
are "find the first existent PCI device at this address or higher",
with the caller expected to increment the address between finding
devices.  This does not allow the parameter to distinguish between the
two cases "start from address zero" and "wrapped after incrementing
maximal possible address", which could therefore lead to an infinite
loop in the degenerate case that a device with address ffff:ff:1f.7
really exists.

Fix by checking for wraparound in the caller (which is already
responsible for performing the increment).

Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown
2022-09-15 15:04:01 +01:00
parent 8fc3c26eae
commit 56b30364c5
3 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/drivers/bus/pci.c
View File

@@ -352,8 +352,7 @@ static int pcibus_probe ( struct root_device *rootdev ) {
uint32_t busdevfn = 0;
int rc;
for ( busdevfn = 0 ; 1 ; busdevfn++ ) {
do {
/* Allocate struct pci_device */
if ( ! pci )
pci = malloc ( sizeof ( *pci ) );
@@ -386,7 +385,8 @@ static int pcibus_probe ( struct root_device *rootdev ) {
/* Not registered; re-use struct pci_device */
list_del ( &pci->dev.siblings );
}
}
} while ( ++busdevfn );
free ( pci );
return 0;