Commit 445ec321 authored Jun 05, 2018 by Rex Zhu Committed by Bjorn Helgaas Jun 29, 2018

PCI: Avoid accessing memory outside the ROM BAR



pci_get_rom_size() accepts the base and size of the ROM BAR as arguments.
The byte at "rom + size" is the first byte *past* the ROM, so change ">" to
">=" to avoid accessing beyond the actual length of the ROM BAR.

Signed-off-by: Rex Zhu <Rex.Zhu@amd.com>
[bhelgaas: changelog]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>

parent 11eb0e0e

drivers/pci/rom.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -106,7 +106,7 @@ size_t pci_get_rom_size(struct pci_dev pdev, void __iomem rom, size_t size)
		length = readw(pds + 16);
		image += length * 512;
		/* Avoid iterating through memory outside the resource window */
		if (image > rom + size)
		if (image >= rom + size)
		break;
		} while (length && !last_image);