⬢ DragonFlyBSD Kernel Audit
DF-5454 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
diff --git asys/bus/pci/x86_64/pci_cfgreg.c.orig bsys/bus/pci/x86_64/pci_cfgreg.c
index 33a4f302..ee9db93d 100644
--- a/sys/bus/pci/x86_64/pci_cfgreg.c
+++ b/sys/bus/pci/x86_64/pci_cfgreg.c
@@ -320,7 +320,9 @@ pciereg_cfgread(int bus, unsigned slot, unsigned func, unsigned reg,
 	int data = -1;
 
 	if (bus < pcie_minbus || bus > pcie_maxbus || slot > PCI_SLOTMAX ||
-	    func > PCI_FUNCMAX || reg > PCIE_REGMAX)
+	    func > PCI_FUNCMAX || reg > PCIE_REGMAX ||
+	    (bytes != 1 && bytes != 2 && bytes != 4) ||
+	    (reg & (bytes - 1)) != 0 || reg + bytes > PCIE_REGMAX + 1)
 		return -1;
 
 	va = PCIE_VADDR(pcie_base, reg, bus, slot, func);
@@ -346,7 +348,9 @@ pciereg_cfgwrite(int bus, unsigned slot, unsigned func, unsigned reg, int data,
 	volatile vm_offset_t va;
 
 	if (bus < pcie_minbus || bus > pcie_maxbus || slot > PCI_SLOTMAX ||
-	    func > PCI_FUNCMAX || reg > PCIE_REGMAX)
+	    func > PCI_FUNCMAX || reg > PCIE_REGMAX ||
+	    (bytes != 1 && bytes != 2 && bytes != 4) ||
+	    (reg & (bytes - 1)) != 0 || reg + bytes > PCIE_REGMAX + 1)
 		return;
 
 	va = PCIE_VADDR(pcie_base, reg, bus, slot, func);