• Thomas Gleixner's avatar
    x86/PCI: Prevent mmconfig memory corruption · bb8d4133
    Thomas Gleixner authored
    commit ff097ddd (x86/PCI: MMCONFIG: manage pci_mmcfg_region as a
    list, not a table) introduced a nasty memory corruption when
    pci_mmcfg_list is empty.
    
    pci_mmcfg_check_end_bus_number() dereferences pci_mmcfg_list.prev even
    when the list is empty. The following write hits some variable near to
    pci_mmcfg_list.
    
    Further down a similar problem exists, where cfg->list.next is
    dereferenced unconditionally and a comparison with some variable near
    to pci_mmcfg_list happens.
    
    Add a check for the last element into the for_each_entry() loop and
    remove all the other crappy logic which is just a leftover of the old
    array based code which was replaced by the list conversion.
    Reported-by: default avatarIngo Molnar <mingo@elte.hu>
    Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
    Cc: Bjorn Helgaas <bjorn.helgaas@hp.com>
    Cc: Yinghai Lu <yinghai@kernel.org>
    Cc: stable@kernel.org
    Signed-off-by: default avatarJesse Barnes <jbarnes@virtuousgeek.org>
    bb8d4133
mmconfig-shared.c 15.3 KB