diff options
| author | Carlos Bilbao <carlos.bilbao@kernel.org> | 2026-04-10 16:02:59 -0700 |
|---|---|---|
| committer | Bjorn Helgaas <bhelgaas@google.com> | 2026-06-22 15:23:00 -0500 |
| commit | 854bd081c7680029d7886689f6bef8f740625fde (patch) | |
| tree | cbd74c787fd6c2bf31bfb8e026c61e4137f063f4 /drivers/misc | |
| parent | e4f26243953fd3e87df93786b40293ca3a6a465e (diff) | |
| download | linux-next-854bd081c7680029d7886689f6bef8f740625fde.tar.gz linux-next-854bd081c7680029d7886689f6bef8f740625fde.zip | |
misc: pci_endpoint_test: Validate BAR index in doorbell test
pci_endpoint_test_doorbell() reads the BAR number directly from an endpoint
test register and uses it as an index into test->bar[]. Add a defensive
bounds check before the dereference: positive values >= PCI_STD_NUM_BARS
are out of range, and NO_BAR (-1) as a negative signed value would slip
past an upper-bound-only check.
Signed-off-by: Carlos Bilbao (Lambda) <carlos.bilbao@kernel.org>
[mani: changed errno to -ERANGE]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260410230300.135631-2-carlos.bilbao@kernel.org
Diffstat (limited to 'drivers/misc')
| -rw-r--r-- | drivers/misc/pci_endpoint_test.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c index dbd017cabbb9..64ac7c7c90af 100644 --- a/drivers/misc/pci_endpoint_test.c +++ b/drivers/misc/pci_endpoint_test.c @@ -1108,6 +1108,11 @@ static int pci_endpoint_test_doorbell(struct pci_endpoint_test *test) pci_endpoint_test_writel(test, PCI_ENDPOINT_TEST_STATUS, 0); bar = pci_endpoint_test_readl(test, PCI_ENDPOINT_TEST_DB_BAR); + if (bar < BAR_0 || bar >= PCI_STD_NUM_BARS) { + dev_err(dev, "BAR %d reported by endpoint out of range [0, %u]\n", + bar, PCI_STD_NUM_BARS - 1); + return -ERANGE; + } writel(data, test->bar[bar] + addr); |