From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out30-132.freemail.mail.aliyun.com (out30-132.freemail.mail.aliyun.com [115.124.30.132]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E507D224B06 for ; Thu, 27 Nov 2025 01:58:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.30.132 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764208722; cv=none; b=C8JhZRGnGJf/dItz+IDcamjRLGm0nASGuIqFygOs5KMj2ugM+edfL+KajSz0bRcC6iu+fUXFr8VPcgZ+Y7DQPdFt952jYTs77qAiwl3Gu6G9xhhl/PEVBHGZW8ncL05EvJm4V3aM7IRwz4x2OQEhZYORWmyX2kPGIJh83iq3KA0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764208722; c=relaxed/simple; bh=kdVLUWfLDblfEoPpmUDeTkHI0ORVXR+rjta74w4QBgo=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=egL6r1wLnSO0sE1LCp6sNlt0JbCWQOuRzEt8QLGvaO4G0W001jdmZI2eD68CM3LGXxsmPL6usmxTRxijzBpF78or2Ki/x6LR62D80uS3hCJqGDqdJLVsG/YrQJheZFZZU9I24THNTxXyu1sLLfbBFExopWu75BVWoFPV2oXTg8s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com; spf=pass smtp.mailfrom=linux.alibaba.com; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b=Uj8t0lup; arc=none smtp.client-ip=115.124.30.132 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b="Uj8t0lup" DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1764208712; h=Message-ID:Date:MIME-Version:Subject:To:From:Content-Type; bh=iuWw1dMghUYQNqOIu31fMoGqtizgc3eneR7CNbpogDM=; b=Uj8t0lupB7KUtqfgJkRCA9YRcExoTq3VKtgnJsr5ctNotBSPT4rtPB29U1vqzvr676NmnhVxDN6kqvHliaQZpECtlGzsQ8SoixmZbSK0vFwIJWiKXYdbLMzHE8nHdyhCGmULJ3tciaV7SQpz/eyD4qum803CAv1ZJe0mujNlr2k= Received: from 30.178.66.176(mailfrom:kanie@linux.alibaba.com fp:SMTPD_---0WtV90H2_1764208711 cluster:ay36) by smtp.aliyun-inc.com; Thu, 27 Nov 2025 09:58:32 +0800 Message-ID: <89568cc6-4251-4d59-9794-0a76adf3b7a8@linux.alibaba.com> Date: Thu, 27 Nov 2025 09:58:31 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: =?UTF-8?B?TW96aWxsYSBUaHVuZGVyYmlyZCDmtYvor5XniYg=?= Subject: Re: [PATCH v4] PCI: Check rom header and data structure addr before accessing To: Andy Shevchenko Cc: Bjorn Helgaas , linux-kernel@vger.kernel.org References: <20251126125727.57620-1-kanie@linux.alibaba.com> From: Guixin Liu In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit 在 2025/11/27 01:42, Andy Shevchenko 写道: > On Wed, Nov 26, 2025 at 07:39:18PM +0200, Andy Shevchenko wrote: >> On Wed, Nov 26, 2025 at 08:57:27PM +0800, Guixin Liu wrote: > ... > >>> image = rom; >>> do { >>> void __iomem *pds; >>> + >>> + if (!pci_rom_header_valid(pdev, image, rom, size, true)) >>> break; >>> + >>> /* get the PCI data structure and check its "PCIR" signature */ >>> pds = image + readw(image + 24); >>> + if (!pci_rom_data_struct_valid(pdev, pds, rom, size)) >>> break; >>> + >>> + last_image = !!(readb(pds + 21) & 0x80); >> !!() is not needed. >> >> last_image = readb(pds + 21) & 0x80; > And while at it, isn't this a bit field and > > last_image = readb(pds + 21) & BIT(7); > > is even more descriptive? Please, check with specification and if it's > a (single) bit, also change this. > Sure, changed in v5. Best Regards Guixin Liu >>> length = readw(pds + 16); >>> image += length * 512; >>> + >>> + if (!pci_rom_header_valid(pdev, image, rom, size, last_image)) >>> break; >>> } while (length && !last_image);