[PATCH 10/24] serial: 8250: pericom: validate port offset against BAR length

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Joshua Rogers <linux@joshua.hu>

The fourth port on 4-port Pericom devices uses offset 0x38 instead of
the linear 0x18, but maxnr is computed assuming uniform 8-byte spacing.
A malicious PCI device with an undersized BAR could cause I/O access
outside the assigned resource. Check that offset + 8 fits within the BAR
before registering each port.

Cc: Jiri Slaby <jirislaby@kernel.org>
Cc: stable <stable@kernel.org>
Signed-off-by: Joshua Rogers <linux@joshua.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/8250/8250_pericom.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/tty/serial/8250/8250_pericom.c b/drivers/tty/serial/8250/8250_pericom.c
index bbbf48c6d07d..f7a7a3f737be 100644
--- a/drivers/tty/serial/8250/8250_pericom.c
+++ b/drivers/tty/serial/8250/8250_pericom.c
@@ -123,6 +123,9 @@ static int pericom8250_probe(struct pci_dev *pdev, const struct pci_device_id *i
 	for (i = 0; i < nr && i < maxnr; i++) {
 		unsigned int offset = (i == 3 && nr == 4) ? 0x38 : i * 0x8;
 
+		if (offset + 8 > pci_resource_len(pdev, bar))
+			break;
+
 		uart.port.iobase = pci_resource_start(pdev, bar) + offset;
 
 		dev_dbg(&pdev->dev, "Setup PCI port: port %lx, irq %d, type %d\n",

-- 
2.56.0