NetworkPkg/SnpDxe: Prevent invalid PCI BAR access

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1563

SnpDxe initializes values for MemoryBarIndex and IoBarIndex to 0 and 1
respectively even if calls to PciIo->GetBarAttributes never return
success.

Later, if the BAR is used to perform IO/Mem reads/writes, a potentially
non-existent BAR index may be accessed. This change initializes the
values
to an invalid BAR index (PCI_MAX_BAR) so the condition can be explicitly
checked to avoid an invalid BAR access.

Cc: Siyuan Fu <siyuan.fu@intel.com>
Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>
Cc: Jiaxin Wu <jiaxin.wu@intel.com>
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>
Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>

diff --git a/NetworkPkg/SnpDxe/Callback.c b/NetworkPkg/SnpDxe/Callback.c
index 0c0b81fdca8ee5d9bdf0183f67d217e301ca45c5..99b7fd3ef8357cb547f81b520bc40ac8ad4996ce 100644 (file)
--- a/NetworkPkg/SnpDxe/Callback.c
+++ b/NetworkPkg/SnpDxe/Callback.c
@@ -4,6 +4,7 @@
   stores the interface context for the NIC that snp is trying to talk.\r
 \r
 Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) Microsoft Corporation.<BR>\r
 SPDX-License-Identifier: BSD-2-Clause-Patent\r
 \r
 **/\r
@@ -115,47 +116,59 @@ SnpUndi32CallbackMemio (
 \r
   switch (ReadOrWrite) {\r
   case PXE_IO_READ:\r
-    Snp->PciIo->Io.Read (\r
-                     Snp->PciIo,\r
-                     Width,\r
-                     Snp->IoBarIndex,      // BAR 1 (for 32bit regs), IO base address\r
-                     MemOrPortAddr,\r
-                     1,                    // count\r
-                     (VOID *) (UINTN) BufferPtr\r
-                     );\r
+    ASSERT (Snp->IoBarIndex < PCI_MAX_BAR);\r
+    if (Snp->IoBarIndex < PCI_MAX_BAR) {\r
+      Snp->PciIo->Io.Read (\r
+                       Snp->PciIo,\r
+                       Width,\r
+                       Snp->IoBarIndex,      // BAR 1 (for 32bit regs), IO base address\r
+                       MemOrPortAddr,\r
+                       1,                    // count\r
+                       (VOID *) (UINTN) BufferPtr\r
+                       );\r
+    }\r
     break;\r
 \r
   case PXE_IO_WRITE:\r
-    Snp->PciIo->Io.Write (\r
-                     Snp->PciIo,\r
-                     Width,\r
-                     Snp->IoBarIndex,      // BAR 1 (for 32bit regs), IO base address\r
-                     MemOrPortAddr,\r
-                     1,                    // count\r
-                     (VOID *) (UINTN) BufferPtr\r
-                     );\r
+    ASSERT (Snp->IoBarIndex < PCI_MAX_BAR);\r
+    if (Snp->IoBarIndex < PCI_MAX_BAR) {\r
+      Snp->PciIo->Io.Write (\r
+                       Snp->PciIo,\r
+                       Width,\r
+                       Snp->IoBarIndex,      // BAR 1 (for 32bit regs), IO base address\r
+                       MemOrPortAddr,\r
+                       1,                    // count\r
+                       (VOID *) (UINTN) BufferPtr\r
+                       );\r
+    }\r
     break;\r
 \r
   case PXE_MEM_READ:\r
-    Snp->PciIo->Mem.Read (\r
-                      Snp->PciIo,\r
-                      Width,\r
-                      Snp->MemoryBarIndex,  // BAR 0, Memory base address\r
-                      MemOrPortAddr,\r
-                      1,                    // count\r
-                      (VOID *) (UINTN) BufferPtr\r
-                      );\r
+    ASSERT (Snp->MemoryBarIndex < PCI_MAX_BAR);\r
+    if (Snp->MemoryBarIndex < PCI_MAX_BAR) {\r
+      Snp->PciIo->Mem.Read (\r
+                        Snp->PciIo,\r
+                        Width,\r
+                        Snp->MemoryBarIndex,  // BAR 0, Memory base address\r
+                        MemOrPortAddr,\r
+                        1,                    // count\r
+                        (VOID *) (UINTN) BufferPtr\r
+                        );\r
+    }\r
     break;\r
 \r
   case PXE_MEM_WRITE:\r
-    Snp->PciIo->Mem.Write (\r
-                      Snp->PciIo,\r
-                      Width,\r
-                      Snp->MemoryBarIndex,  // BAR 0, Memory base address\r
-                      MemOrPortAddr,\r
-                      1,                    // count\r
-                      (VOID *) (UINTN) BufferPtr\r
-                      );\r
+    ASSERT (Snp->MemoryBarIndex < PCI_MAX_BAR);\r
+    if (Snp->MemoryBarIndex < PCI_MAX_BAR) {\r
+      Snp->PciIo->Mem.Write (\r
+                        Snp->PciIo,\r
+                        Width,\r
+                        Snp->MemoryBarIndex,  // BAR 0, Memory base address\r
+                        MemOrPortAddr,\r
+                        1,                    // count\r
+                        (VOID *) (UINTN) BufferPtr\r
+                        );\r
+    }\r
     break;\r
   }\r
 \r

diff --git a/NetworkPkg/SnpDxe/Snp.c b/NetworkPkg/SnpDxe/Snp.c
index fe022e16eacc5584423182e27136736dc13d4898..69e74132ed704a5dd39d43ac41c9d3fb2c2d161e 100644 (file)
--- a/NetworkPkg/SnpDxe/Snp.c
+++ b/NetworkPkg/SnpDxe/Snp.c
@@ -466,8 +466,8 @@ SimpleNetworkDriverStart (
   // the IO BAR.  Save the index of the BAR into the adapter info structure.\r
   // for regular 32bit BARs, 0 is memory mapped, 1 is io mapped\r
   //\r
-  Snp->MemoryBarIndex = 0;\r
-  Snp->IoBarIndex     = 1;\r
+  Snp->MemoryBarIndex = PCI_MAX_BAR;\r
+  Snp->IoBarIndex     = PCI_MAX_BAR;\r
   FoundMemoryBar      = FALSE;\r
   FoundIoBar          = FALSE;\r
   for (BarIndex = 0; BarIndex < PCI_MAX_BAR; BarIndex++) {\r