[Xen-changelog] [xen-unstable] VT-d: Make ACPI DMAR parsing more robust

[Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User Keir Fraser <keir.fraser@xxxxxxxxxx>
# Date 1207217990 -3600
# Node ID a7181b2f7d446a1de6ec397126961ffa799d76cc
# Parent  d48551c66377a6e4006cd8ee360d466600f9c2ad
VT-d: Make ACPI DMAR parsing more robust

Parsing ACPI related VT-d tables may cause infinite loop due to u8
value wraparound.  Also add sanity check on table length entry.

Signed-off-by: Espen Skoglund <espen.skoglund@xxxxxxxxxxxxx>
---
 xen/drivers/passthrough/vtd/dmar.c |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diff -r d48551c66377 -r a7181b2f7d44 xen/drivers/passthrough/vtd/dmar.c
--- a/xen/drivers/passthrough/vtd/dmar.c        Wed Apr 02 15:46:52 2008 +0100
+++ b/xen/drivers/passthrough/vtd/dmar.c        Thu Apr 03 11:19:50 2008 +0100
@@ -211,7 +211,7 @@ static int scope_device_count(void *star
 static int scope_device_count(void *start, void *end)
 {
     struct acpi_dev_scope *scope;
-    u8 bus, sub_bus, sec_bus;
+    u16 bus, sub_bus, sec_bus;
     struct acpi_pci_path *path;
     int depth, count = 0;
     u8 dev, func;
@@ -231,7 +231,7 @@ static int scope_device_count(void *star
         bus = scope->start_bus;
         depth = (scope->length - sizeof(struct acpi_dev_scope))
                    / sizeof(struct acpi_pci_path);
-        while ( --depth )
+        while ( --depth >= 0 )
         {
             bus = read_pci_config_byte(
                 bus, path->dev, path->fn, PCI_SECONDARY_BUS);
@@ -301,7 +301,7 @@ static int __init acpi_parse_dev_scope(
     void *start, void *end, void *acpi_entry, int type)
 {
     struct acpi_dev_scope *scope;
-    u8 bus, sub_bus, sec_bus;
+    u16 bus, sub_bus, sec_bus;
     struct acpi_pci_path *path;
     struct acpi_ioapic_unit *acpi_ioapic_unit = NULL;
     int depth;
@@ -353,7 +353,7 @@ static int __init acpi_parse_dev_scope(
                    / sizeof(struct acpi_pci_path);
         bus = scope->start_bus;
 
-        while ( --depth )
+        while ( --depth >= 0 )
         {
             bus = read_pci_config_byte(
                 bus, path->dev, path->fn, PCI_SECONDARY_BUS);

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog