CVS commit: src/sys/dev/acpi

[Grégoire Sutre]

Module Name:    src
Committed By:   gsutre
Date:           Sun Aug  8 16:26:47 UTC 2010

Modified Files:
        src/sys/dev/acpi: acpi_pci.c

Log Message:
acpi_pcidev_scan: discard invalid PCI addresses.


To generate a diff of this commit:
cvs rdiff -u -r1.12 -r1.13 src/sys/dev/acpi/acpi_pci.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


Modified files:

Index: src/sys/dev/acpi/acpi_pci.c
diff -u src/sys/dev/acpi/acpi_pci.c:1.12 src/sys/dev/acpi/acpi_pci.c:1.13
--- src/sys/dev/acpi/acpi_pci.c:1.12	Wed Jun  9 04:20:10 2010
+++ src/sys/dev/acpi/acpi_pci.c	Sun Aug  8 16:26:47 2010
@@ -1,4 +1,4 @@
-/* $NetBSD: acpi_pci.c,v 1.12 2010/06/09 04:20:10 mrg Exp $ */
+/* $NetBSD: acpi_pci.c,v 1.13 2010/08/08 16:26:47 gsutre Exp $ */
 
 /*
  * Copyright (c) 2009, 2010 The NetBSD Foundation, Inc.
@@ -29,7 +29,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: acpi_pci.c,v 1.12 2010/06/09 04:20:10 mrg Exp $");
+__KERNEL_RCSID(0, "$NetBSD: acpi_pci.c,v 1.13 2010/08/08 16:26:47 gsutre Exp $");
 
 #include <sys/param.h>
 #include <sys/device.h>
@@ -163,11 +163,11 @@
 	ACPI_INTEGER val;
 	ACPI_STATUS rv;
 
+	ad->ad_pciinfo = NULL;
+
 	if (ad->ad_devinfo->Type != ACPI_TYPE_DEVICE ||
-	    !(ad->ad_devinfo->Valid & ACPI_VALID_ADR)) {
-		ad->ad_pciinfo = NULL;
+	    !(ad->ad_devinfo->Valid & ACPI_VALID_ADR))
 		goto rec;
-	}
 
 	if (ad->ad_devinfo->Flags & ACPI_PCI_ROOT_BRIDGE) {
 
@@ -200,6 +200,14 @@
 		ap->ap_device = ACPI_HILODWORD(ad->ad_devinfo->Address);
 		ap->ap_function = ACPI_LOLODWORD(ad->ad_devinfo->Address);
 
+		if (ap->ap_bus > 255 || ap->ap_device > 31 ||
+		    ap->ap_function > 7) {
+			aprint_error_dev(ad->ad_root,
+			    "invalid PCI address for %s\n", ad->ad_name);
+			kmem_free(ap, sizeof(*ap));
+			goto rec;
+		}
+
 		ap->ap_bridge = true;
 		ap->ap_downbus = ap->ap_bus;
 
@@ -228,6 +236,13 @@
 		ap->ap_device = ACPI_HILODWORD(ad->ad_devinfo->Address);
 		ap->ap_function = ACPI_LOLODWORD(ad->ad_devinfo->Address);
 
+		if (ap->ap_device > 31 || ap->ap_function > 7) {
+			aprint_error_dev(ad->ad_root,
+			    "invalid PCI address for %s\n", ad->ad_name);
+			kmem_free(ap, sizeof(*ap));
+			goto rec;
+		}
+
 		/*
 		 * Check whether this device is a PCI-to-PCI
 		 * bridge and get its secondary bus number.
@@ -256,8 +271,8 @@
  * acpi_pcidev_ppb_downbus:
  *
  *	Retrieve the secondary bus number of the PCI-to-PCI bridge having the
- *	given PCI id.  If successful, return AE_OK and fill *busp.  Otherwise,
- *	return an exception code and leave *busp unchanged.
+ *	given PCI id.  If successful, return AE_OK and fill *downbus.
+ *	Otherwise, return an exception code and leave *downbus unchanged.
  *
  * XXX	Need to deal with PCI segment groups (see also acpica/OsdHardware.c).
  */