[PATCH 1/2] misc: pci_endpoint_test: validate BAR index in doorbell test

[carlos . bilbao]

From: Carlos Bilbao <carlos.bilbao@xxxxxxxxxx>

pci_endpoint_test_doorbell() reads the BAR number directly from an endpoint
test register and uses it as an index into test->bar[] without bounds
checking. Since the value is a raw u32 from device MMIO, any value is
possible and if greater than or equal to PCI_STD_NUM_BARS the access goes
out of bounds.

Add a bounds check before dereferencing test->bar[bar].

Fixes: eefb83790a0d ("misc: pci_endpoint_test: Add doorbell test case")
Signed-off-by: Carlos Bilbao (Lambda) <carlos.bilbao@xxxxxxxxxx>
---
 drivers/misc/pci_endpoint_test.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
index 74ab5b5b9011..276bed3f1c18 100644
--- a/drivers/misc/pci_endpoint_test.c
+++ b/drivers/misc/pci_endpoint_test.c
@@ -1089,6 +1089,11 @@ static int pci_endpoint_test_doorbell(struct pci_endpoint_test *test)
 	pci_endpoint_test_writel(test, PCI_ENDPOINT_TEST_STATUS, 0);
 
 	bar = pci_endpoint_test_readl(test, PCI_ENDPOINT_TEST_DB_BAR);
+	if (bar >= PCI_STD_NUM_BARS) {
+		dev_err(dev, "BAR %u reported by endpoint out of range [0, %u]\n",
+			bar, PCI_STD_NUM_BARS - 1);
+		return -EINVAL;
+	}
 
 	writel(data, test->bar[bar] + addr);
 
-- 
2.43.0