Message ID | 20231030114218.2752236-1-andriy.shevchenko@linux.intel.com |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:d641:0:b0:403:3b70:6f57 with SMTP id cy1csp2142496vqb; Mon, 30 Oct 2023 04:42:34 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGibKbpVxyCuETIwlK0f9DdjAYdG8IKzv9907Q5UY3WI+4i6TOipBBNxlD0RNdcA+0xJ7sy X-Received: by 2002:a05:6a20:c1a8:b0:162:edc2:4e9f with SMTP id bg40-20020a056a20c1a800b00162edc24e9fmr7639870pzb.62.1698666153706; Mon, 30 Oct 2023 04:42:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1698666153; cv=none; d=google.com; s=arc-20160816; b=lv3LLr/agBuVBn7BD7JisvRx+CXi476e7WJKW3SRF1ElToOwo7OmLiCU2CMP+07Xf4 G1yWvA2hT0HSUnRJPSB+lFVB/ZhUcnlvUrcqNY3yoj430Od58kwK1I+p7CGbxaARtWXJ hXvb/gAVO3laZfRtUSMigvdnE7Cy0eYYJOMZVAXrTDjKoVM0Igpf/tKE2eoR6SQ6GKvj GlENZgO72W/kz+D0UM5MxyBxebIImyGprytLGfFiDMZG/U2+8/vXAm5wC6n1dUZyYdmv p8wJR3MiCq8NTCLIQdUqSi8uenVTZlDnRWY56F26c4T1vwQH757aKwsMEjaj7WWFqMa9 D7HA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=J3zNFHi5AskaOYuUgga3XoMsSsGBH8+vlufF8WXK4I4=; fh=g9I+OB+d+feXXQbviWQWyTqaW/D3JLh5FnICjmYPj/I=; b=qBB8uompoqcKL5mL44M0MKWq1h0YFwASndKVG33K/vIAHsV2awzWB1lf/EOX4kWYOi q5Ykv60zkmfPhPtY2yYn8VpP3Yzbn3alnu6hd13Az5uKpIIlonb25V7Ex6IdDEspfagW +JRhhrLhXEsPxc/g4fRyWMfe+4QOWavuT7sbLnIQtg0bVNX/6voot05nljiDY8HpxvpK d4cmE2tPItu3nEC5ak289i4upSnTPj0nPzk/E4r9w/rB9FP38Ul2QGK1AF8MimymSR9M GPqFV+7A5v3nxeSDEzpPRUTH28x+wonnbPxA8pU+XsGU+ueOBSYONaHTz+VIl+QZAHBh r+Og== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=doUKXhMN; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.37 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from snail.vger.email (snail.vger.email. [23.128.96.37]) by mx.google.com with ESMTPS id o5-20020a170903300500b001cc3527145bsi2911387pla.29.2023.10.30.04.42.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 30 Oct 2023 04:42:33 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.37 as permitted sender) client-ip=23.128.96.37; Authentication-Results: mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=doUKXhMN; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.37 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by snail.vger.email (Postfix) with ESMTP id 0AF1980C110F; Mon, 30 Oct 2023 04:42:32 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at snail.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232991AbjJ3Lm3 (ORCPT <rfc822;zxc52fgh@gmail.com> + 31 others); Mon, 30 Oct 2023 07:42:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32988 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229456AbjJ3Lm2 (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Mon, 30 Oct 2023 07:42:28 -0400 Received: from mgamail.intel.com (mgamail.intel.com [134.134.136.100]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2A53CB6; Mon, 30 Oct 2023 04:42:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1698666146; x=1730202146; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=Wgjl1H5YZOAljBGcZUVinUUuvxtEN2OCmrNb2NgLeng=; b=doUKXhMNdagXxFYh3KG1aEdrhf3KRRvUpOWezGSMVOLVQY+wcZwZIOHg PdLrgxFAnpK2h/NieygqkFR7tJsQofvT4fW4nMlZP7B8ILYZmCem+SbXU c9yJudKin8MVFFF/uhdzEBwbfJpn+kWUW7rZNHDhpVajtL5oan1y0umwY n9nQb7AzXJMwAs+bgVGnKIpRrpYVp2DlAf1la5UdGYgfZ2dpmRdqWlQEt R52KvaZAdu+FPhZWMVCx0xci/diIf9scWl7SJi6vfBfAWnWG1Qb9wfdTW 5Y1b7jEnXH1peHpawju2RdSAlpXtjZuZchEseWzvvdeYmiUcAr49yvPNU g==; X-IronPort-AV: E=McAfee;i="6600,9927,10878"; a="454519518" X-IronPort-AV: E=Sophos;i="6.03,263,1694761200"; d="scan'208";a="454519518" Received: from orsmga004.jf.intel.com ([10.7.209.38]) by orsmga105.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Oct 2023 04:42:25 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10878"; a="883836795" X-IronPort-AV: E=Sophos;i="6.03,263,1694761200"; d="scan'208";a="883836795" Received: from black.fi.intel.com ([10.237.72.28]) by orsmga004.jf.intel.com with ESMTP; 30 Oct 2023 04:42:23 -0700 Received: by black.fi.intel.com (Postfix, from userid 1003) id 6AFD02BF; Mon, 30 Oct 2023 13:42:22 +0200 (EET) From: Andy Shevchenko <andriy.shevchenko@linux.intel.com> To: Bjorn Helgaas <bhelgaas@google.com>, linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>, Bjorn Helgaas <helgaas@kernel.org>, Jonas Gorski <jonas.gorski@gmail.com> Subject: [PATCH v1 1/1] PCI: Avoid potential out-of-bounds read in pci_dev_for_each_resource() Date: Mon, 30 Oct 2023 13:42:18 +0200 Message-Id: <20231030114218.2752236-1-andriy.shevchenko@linux.intel.com> X-Mailer: git-send-email 2.40.0.1.gaa8946217a0b MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-2.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_EF,RCVD_IN_DNSWL_BLOCKED, SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (snail.vger.email [0.0.0.0]); Mon, 30 Oct 2023 04:42:32 -0700 (PDT) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1781180560956708523 X-GMAIL-MSGID: 1781180560956708523 |
Series |
[v1,1/1] PCI: Avoid potential out-of-bounds read in pci_dev_for_each_resource()
|
|
Commit Message
Andy Shevchenko
Oct. 30, 2023, 11:42 a.m. UTC
Coverity complains that pointer in the pci_dev_for_each_resource()
may be wrong, i.e. mighe be used for the out-of-bounds read.
There is no actual issue right now, because we have another check
afterwards and the out-of-bounds read is not being performed. In any
case it's better code with this get fixed, hence the proposed change.
As Jonas pointed out "It probably makes the code slightly less
performant as res will now be checked for being not NULL (which will
always be true), but I doubt it will be significant (or in any hot
paths)."
Fixes: 09cc90063240 ("PCI: Introduce pci_dev_for_each_resource()")
Reported-by: Bjorn Helgaas <helgaas@kernel.org>
Closes: https://lore.kernel.org/r/20230509182122.GA1259567@bhelgaas
Suggested-by: Jonas Gorski <jonas.gorski@gmail.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
include/linux/pci.h | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
Comments
On Mon, Oct 30, 2023 at 01:42:18PM +0200, Andy Shevchenko wrote: > Coverity complains that pointer in the pci_dev_for_each_resource() > may be wrong, i.e. mighe be used for the out-of-bounds read. > > There is no actual issue right now, because we have another check > afterwards and the out-of-bounds read is not being performed. In any > case it's better code with this get fixed, hence the proposed change. > > As Jonas pointed out "It probably makes the code slightly less > performant as res will now be checked for being not NULL (which will > always be true), but I doubt it will be significant (or in any hot > paths)." > > Fixes: 09cc90063240 ("PCI: Introduce pci_dev_for_each_resource()") > Reported-by: Bjorn Helgaas <helgaas@kernel.org> > Closes: https://lore.kernel.org/r/20230509182122.GA1259567@bhelgaas > Suggested-by: Jonas Gorski <jonas.gorski@gmail.com> > Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Thanks, Andy, I'll look at this soon after v6.7-rc1 (probably Nov 12). > --- > include/linux/pci.h | 12 ++++++------ > 1 file changed, 6 insertions(+), 6 deletions(-) > > diff --git a/include/linux/pci.h b/include/linux/pci.h > index 60ca768bc867..19adad23a204 100644 > --- a/include/linux/pci.h > +++ b/include/linux/pci.h > @@ -2127,14 +2127,14 @@ int pci_iobar_pfn(struct pci_dev *pdev, int bar, struct vm_area_struct *vma); > (pci_resource_end((dev), (bar)) ? \ > resource_size(pci_resource_n((dev), (bar))) : 0) > > -#define __pci_dev_for_each_res0(dev, res, ...) \ > - for (unsigned int __b = 0; \ > - res = pci_resource_n(dev, __b), __b < PCI_NUM_RESOURCES; \ > +#define __pci_dev_for_each_res0(dev, res, ...) \ > + for (unsigned int __b = 0; \ > + __b < PCI_NUM_RESOURCES && (res = pci_resource_n(dev, __b)); \ > __b++) > > -#define __pci_dev_for_each_res1(dev, res, __b) \ > - for (__b = 0; \ > - res = pci_resource_n(dev, __b), __b < PCI_NUM_RESOURCES; \ > +#define __pci_dev_for_each_res1(dev, res, __b) \ > + for (__b = 0; \ > + __b < PCI_NUM_RESOURCES && (res = pci_resource_n(dev, __b)); \ > __b++) > > #define pci_dev_for_each_resource(dev, res, ...) \ > -- > 2.40.0.1.gaa8946217a0b >
On Fri, Nov 03, 2023 at 01:46:14PM -0500, Bjorn Helgaas wrote: > On Mon, Oct 30, 2023 at 01:42:18PM +0200, Andy Shevchenko wrote: > > Coverity complains that pointer in the pci_dev_for_each_resource() > > may be wrong, i.e. mighe be used for the out-of-bounds read. > > > > There is no actual issue right now, because we have another check > > afterwards and the out-of-bounds read is not being performed. In any > > case it's better code with this get fixed, hence the proposed change. > > > > As Jonas pointed out "It probably makes the code slightly less > > performant as res will now be checked for being not NULL (which will > > always be true), but I doubt it will be significant (or in any hot > > paths)." > > > > Fixes: 09cc90063240 ("PCI: Introduce pci_dev_for_each_resource()") > > Reported-by: Bjorn Helgaas <helgaas@kernel.org> > > Closes: https://lore.kernel.org/r/20230509182122.GA1259567@bhelgaas > > Suggested-by: Jonas Gorski <jonas.gorski@gmail.com> > > Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> > > Thanks, Andy, I'll look at this soon after v6.7-rc1 (probably Nov 12). Since it's anyway a non-critical issue, take your time. Based on the tags it may be backported if needed, so business as usual. Thank you!
From: Bjorn Helgaas <bhelgaas@google.com> On Mon, 30 Oct 2023 13:42:18 +0200, Andy Shevchenko wrote: > Coverity complains that pointer in the pci_dev_for_each_resource() > may be wrong, i.e. mighe be used for the out-of-bounds read. > > There is no actual issue right now, because we have another check > afterwards and the out-of-bounds read is not being performed. In any > case it's better code with this get fixed, hence the proposed change. > > [...] Applied to "resource" for v6.8, thanks! [1/1] PCI: Avoid potential out-of-bounds read in pci_dev_for_each_resource() commit: 3171e46d677a668eed3086da78671f1e4f5b8405 Best regards,
diff --git a/include/linux/pci.h b/include/linux/pci.h index 60ca768bc867..19adad23a204 100644 --- a/include/linux/pci.h +++ b/include/linux/pci.h @@ -2127,14 +2127,14 @@ int pci_iobar_pfn(struct pci_dev *pdev, int bar, struct vm_area_struct *vma); (pci_resource_end((dev), (bar)) ? \ resource_size(pci_resource_n((dev), (bar))) : 0) -#define __pci_dev_for_each_res0(dev, res, ...) \ - for (unsigned int __b = 0; \ - res = pci_resource_n(dev, __b), __b < PCI_NUM_RESOURCES; \ +#define __pci_dev_for_each_res0(dev, res, ...) \ + for (unsigned int __b = 0; \ + __b < PCI_NUM_RESOURCES && (res = pci_resource_n(dev, __b)); \ __b++) -#define __pci_dev_for_each_res1(dev, res, __b) \ - for (__b = 0; \ - res = pci_resource_n(dev, __b), __b < PCI_NUM_RESOURCES; \ +#define __pci_dev_for_each_res1(dev, res, __b) \ + for (__b = 0; \ + __b < PCI_NUM_RESOURCES && (res = pci_resource_n(dev, __b)); \ __b++) #define pci_dev_for_each_resource(dev, res, ...) \