Commit 05e7a9d2 authored by liwei's avatar liwei
Browse files

PCI/ROM: Fix PCI ROM header check bug 

hulk inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IAEDJI



--------------------------------

In UEFI Specification Version 2.8, describes that the PCIR data structure
 must start on a 4-byte boundary. Add checks to prevent vulnerabilities.

Fixes: d7ad2254 ("[IA64] SN: Correct ROM resource length for BIOS copy")
Signed-off-by: default avatarliwei <liwei728@huawei.com>
parent 1e94b0d2

drivers/pci/rom.c

+6 −0
Original line number Diff line number Diff line
@@ -98,6 +98,12 @@ static size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, 
		}

		/* get the PCI data structure and check its "PCIR" signature */

		pds = image + readw(image + 24);

		/* The PCIR data structure must begin on a 4-byte boundary */

		if (!IS_ALIGNED((unsigned long)pds, 4)) {

			pci_info(pdev, "Invalid PCI ROM header signature: PCIR %#06x\n",

				 readw(image + 24));

			break;

		}

		if (readl(pds) != 0x52494350) {

			pci_info(pdev, "Invalid PCI ROM data signature: expecting 0x52494350, got %#010x\n",

				 readl(pds));