Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit afa63252 authored by Alex Williamson's avatar Alex Williamson
Browse files

vfio/pci: Fix sizing of DPA and THP express capabilities 



When sizing the TPH capability we store the register containing the
table size into the 'dword' variable, but then use the uninitialized
'byte' variable to analyze the size.  The table size is also actually
reported as an N-1 value, so correct sizing to account for this.

The round_up() for both TPH and DPA is unnecessary, remove it.

Detected by Coverity: CID 714665 & 715156

Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
parent c7208164

drivers/vfio/pci/vfio_pci_config.c

+3 −4
Original line number Diff line number Diff line
@@ -1126,8 +1126,7 @@ static int vfio_ext_cap_len(struct vfio_pci_device *vdev, u16 ecap, u16 epos) 
			return pcibios_err_to_errno(ret);



		byte &= PCI_DPA_CAP_SUBSTATE_MASK;

		byte = round_up(byte + 1, 4);

		return PCI_DPA_BASE_SIZEOF + byte;

		return PCI_DPA_BASE_SIZEOF + byte + 1;

	case PCI_EXT_CAP_ID_TPH:

		ret = pci_read_config_dword(pdev, epos + PCI_TPH_CAP, &dword);

		if (ret)
@@ -1136,9 +1135,9 @@ static int vfio_ext_cap_len(struct vfio_pci_device *vdev, u16 ecap, u16 epos) 
		if ((dword & PCI_TPH_CAP_LOC_MASK) == PCI_TPH_LOC_CAP) {

			int sts;



			sts = byte & PCI_TPH_CAP_ST_MASK;

			sts = dword & PCI_TPH_CAP_ST_MASK;

			sts >>= PCI_TPH_CAP_ST_SHIFT;

			return PCI_TPH_BASE_SIZEOF + round_up(sts * 2, 4);

			return PCI_TPH_BASE_SIZEOF + (sts * 2) + 2;

		}

		return PCI_TPH_BASE_SIZEOF;

	default: