[PATCH 11/24] serial: 8250: cap OxSemi Tornado UART count against BAR size

[Greg Kroah-Hartman]

From: Joshua Rogers <linux@xxxxxxxxx>

pci_oxsemi_tornado_init() reads the UART count from device-controlled
BAR0 memory without validation, allowing a malicious device to report up
to 255 ports. Cap the device-reported count against what actually fits
in the BAR using the Tornado register layout.

Cc: Jiri Slaby <jirislaby@xxxxxxxxxx>
Cc: "Uwe Kleine-König (The Capable Hub)" <u.kleine-koenig@xxxxxxxxxxxx>
Cc: Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>
Cc: Bjorn Helgaas <bhelgaas@xxxxxxxxxx>
Cc: Lukas Wunner <lukas@xxxxxxxxx>
Cc: Marnix Rijnart <marnix.rijnart@xxxxxxxx>
Cc: Crescent Hsieh <crescentcy.hsieh@xxxxxxxx>
Cc: stable <stable@xxxxxxxxxx>
Signed-off-by: Joshua Rogers <linux@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
 drivers/tty/serial/8250/8250_pci.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index 1dda63be6b89..9919504334bb 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -1083,6 +1083,7 @@ static int pci_oxsemi_tornado_init(struct pci_dev *dev)
 	u8 __iomem *p;
 	unsigned long deviceID;
 	unsigned int  number_uarts = 0;
+	resource_size_t bar_len;
 
 	if (!pci_oxsemi_tornado_p(dev))
 		return 0;
@@ -1095,6 +1096,15 @@ static int pci_oxsemi_tornado_init(struct pci_dev *dev)
 	/* Tornado device */
 	if (deviceID == 0x07000200) {
 		number_uarts = ioread8(p + 4);
+
+		/* Cap against BAR0 size (Tornado layout: 0x1000 + n * 0x200) */
+		bar_len = pci_resource_len(dev, 0);
+		if (bar_len >= 0x1000)
+			number_uarts = min_t(unsigned int, number_uarts,
+					     (bar_len - 0x1000) / 0x200);
+		else
+			number_uarts = 0;
+
 		pci_dbg(dev, "%d ports detected on %s PCI Express device\n",
 			number_uarts,
 			dev->vendor == PCI_VENDOR_ID_ENDRUN ?

-- 
2.56.0