diff options
| author | Rex Zhu <Rex.Zhu@amd.com> | 2018-06-05 09:46:45 +0800 |
|---|---|---|
| committer | Bjorn Helgaas <bhelgaas@google.com> | 2018-06-29 21:07:17 -0500 |
| commit | 445ec321e71b3124abacfb358f72ac6a70d87602 (patch) | |
| tree | acbecd71b968ec0667bcebed2652d5111edc8e5e | |
| parent | 11eb0e0e8dea8b97cff972b09cf6fb033b729dff (diff) | |
| download | linux-445ec321e71b3124abacfb358f72ac6a70d87602.tar.bz2 | |
PCI: Avoid accessing memory outside the ROM BAR
pci_get_rom_size() accepts the base and size of the ROM BAR as arguments.
The byte at "rom + size" is the first byte *past* the ROM, so change ">" to
">=" to avoid accessing beyond the actual length of the ROM BAR.
Signed-off-by: Rex Zhu <Rex.Zhu@amd.com>
[bhelgaas: changelog]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
| -rw-r--r-- | drivers/pci/rom.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c index a7b5c37a85ec..946795fc0071 100644 --- a/drivers/pci/rom.c +++ b/drivers/pci/rom.c @@ -106,7 +106,7 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size) length = readw(pds + 16); image += length * 512; /* Avoid iterating through memory outside the resource window */ - if (image > rom + size) + if (image >= rom + size) break; } while (length && !last_image); |