i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

virtio_pci: Fix index out of bounds

Browse Source 
* Update size of registersArea[] to fix index out of bounds
in init_bus() and uninit_bus() caused by mismatching
between sizeof(registersArea[]) and loop counters.
Pointed out by cppcheck.
* actually use index to populate registers and registersArea arrays.

Change-Id: Iec6337c7dd475bb86f94fe8f2a7b8fed9776ee28
Reviewed-on: https://review.haiku-os.org/c/haiku/+/8376
Reviewed-by: waddlesplash <[email protected]>
Haiku-Format: Haiku-format Bot <[email protected]>
Tested-by: Commit checker robot <[email protected]>
This commit is contained in:
Jérôme Duval
2024-09-30 15:57:23 +00:00
committed by waddlesplash
parent cbc8ea5218
commit ad747ccb1c
1 changed files with 14 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/add-ons/kernel/busses/virtio/virtio_pci/virtio_pci.cpp
+14 -11
View File
@@ -50,7 +50,7 @@ typedef struct {
pci_device* device; pci_device* device;
bool virtio1; bool virtio1;
addr_t base_addr; addr_t base_addr;
area_id registersArea[4]; area_id registersArea[6];
addr_t commonCfgAddr; addr_t commonCfgAddr;
addr_t isrAddr; addr_t isrAddr;
addr_t notifyAddr; addr_t notifyAddr;
@@ -672,22 +672,25 @@ init_bus(device_node* node, void** bus_cookie)
if (deviceCfgFound && deviceCap.length > 0) if (deviceCfgFound && deviceCap.length > 0)
bars[deviceCap.bar] = max_c(bars[deviceCap.bar], deviceCap.offset + deviceCap.length); bars[deviceCap.bar] = max_c(bars[deviceCap.bar], deviceCap.offset + deviceCap.length);
int index = 0; size_t index = 0;
addr_t registers[6] = {0}; addr_t registers[B_COUNT_OF(bars)] = {0};
for (int i = 0; i < 6; i++) { for (size_t i = 0; i < B_COUNT_OF(bars); i++, index++) {
if (bars[i] == 0) if (bars[index] == 0) {
bus->registersArea[index] = -1;
continue; continue;
}
phys_addr_t barAddr = pciInfo->u.h0.base_registers[i]; phys_addr_t barAddr = pciInfo->u.h0.base_registers[i];
size_t barSize = pciInfo->u.h0.base_register_sizes[i]; size_t barSize = pciInfo->u.h0.base_register_sizes[i];
if ((pciInfo->u.h0.base_register_flags[i] & PCI_address_type) == PCI_address_type_64) { if ((pciInfo->u.h0.base_register_flags[i] & PCI_address_type) == PCI_address_type_64
barAddr |= (uint64)pciInfo->u.h0.base_registers[i + 1] << 32; && i < (B_COUNT_OF(bars) - 1)) {
barSize |= (uint64)pciInfo->u.h0.base_register_sizes[i + 1] << 32; i++;
barAddr |= (uint64)pciInfo->u.h0.base_registers[i] << 32;
barSize |= (uint64)pciInfo->u.h0.base_register_sizes[i] << 32;
} }
bus->registersArea[i] = map_physical_memory("Virtio PCI memory mapped registers", bus->registersArea[index] = map_physical_memory("Virtio PCI memory mapped registers",
barAddr, barSize, B_ANY_KERNEL_ADDRESS, B_KERNEL_READ_AREA | B_KERNEL_WRITE_AREA, barAddr, barSize, B_ANY_KERNEL_ADDRESS, B_KERNEL_READ_AREA | B_KERNEL_WRITE_AREA,
(void **)&registers[i]); (void**)&registers[index]);
index++;
} }
bus->commonCfgAddr = registers[common.bar] + common.offset; bus->commonCfgAddr = registers[common.bar] + common.offset;