From: Michael Kubacki <michael.kubacki@microsoft.com>
Date: Thu, 9 Apr 2020 03:02:05 +0000 (-0700)
Subject: NetworkPkg/SnpDxe: Prevent invalid PCI BAR access
X-Git-Tag: edk2-stable202005~180
X-Git-Url: https://git.proxmox.com/?p=mirror_edk2.git;a=commitdiff_plain;h=df4f154da9cb193b8e539157d1ed1a851cf1488e

NetworkPkg/SnpDxe: Prevent invalid PCI BAR access

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1563

SnpDxe initializes values for MemoryBarIndex and IoBarIndex to 0 and 1
respectively even if calls to PciIo->GetBarAttributes never return
success.

Later, if the BAR is used to perform IO/Mem reads/writes, a potentially
non-existent BAR index may be accessed. This change initializes the
values
to an invalid BAR index (PCI_MAX_BAR) so the condition can be explicitly
checked to avoid an invalid BAR access.

Cc: Siyuan Fu <siyuan.fu@intel.com>
Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>
Cc: Jiaxin Wu <jiaxin.wu@intel.com>
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>
Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
---

diff --git a/NetworkPkg/SnpDxe/Callback.c b/NetworkPkg/SnpDxe/Callback.c
index 0c0b81fdca..99b7fd3ef8 100644
--- a/NetworkPkg/SnpDxe/Callback.c
+++ b/NetworkPkg/SnpDxe/Callback.c
@@ -4,6 +4,7 @@
   stores the interface context for the NIC that snp is trying to talk.
 
 Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>
+Copyright (c) Microsoft Corporation.<BR>
 SPDX-License-Identifier: BSD-2-Clause-Patent
 
 **/
@@ -115,47 +116,59 @@ SnpUndi32CallbackMemio (
 
   switch (ReadOrWrite) {
   case PXE_IO_READ:
-    Snp->PciIo->Io.Read (
-                     Snp->PciIo,
-                     Width,
-                     Snp->IoBarIndex,      // BAR 1 (for 32bit regs), IO base address
-                     MemOrPortAddr,
-                     1,                    // count
-                     (VOID *) (UINTN) BufferPtr
-                     );
+    ASSERT (Snp->IoBarIndex < PCI_MAX_BAR);
+    if (Snp->IoBarIndex < PCI_MAX_BAR) {
+      Snp->PciIo->Io.Read (
+                       Snp->PciIo,
+                       Width,
+                       Snp->IoBarIndex,      // BAR 1 (for 32bit regs), IO base address
+                       MemOrPortAddr,
+                       1,                    // count
+                       (VOID *) (UINTN) BufferPtr
+                       );
+    }
     break;
 
   case PXE_IO_WRITE:
-    Snp->PciIo->Io.Write (
-                     Snp->PciIo,
-                     Width,
-                     Snp->IoBarIndex,      // BAR 1 (for 32bit regs), IO base address
-                     MemOrPortAddr,
-                     1,                    // count
-                     (VOID *) (UINTN) BufferPtr
-                     );
+    ASSERT (Snp->IoBarIndex < PCI_MAX_BAR);
+    if (Snp->IoBarIndex < PCI_MAX_BAR) {
+      Snp->PciIo->Io.Write (
+                       Snp->PciIo,
+                       Width,
+                       Snp->IoBarIndex,      // BAR 1 (for 32bit regs), IO base address
+                       MemOrPortAddr,
+                       1,                    // count
+                       (VOID *) (UINTN) BufferPtr
+                       );
+    }
     break;
 
   case PXE_MEM_READ:
-    Snp->PciIo->Mem.Read (
-                      Snp->PciIo,
-                      Width,
-                      Snp->MemoryBarIndex,  // BAR 0, Memory base address
-                      MemOrPortAddr,
-                      1,                    // count
-                      (VOID *) (UINTN) BufferPtr
-                      );
+    ASSERT (Snp->MemoryBarIndex < PCI_MAX_BAR);
+    if (Snp->MemoryBarIndex < PCI_MAX_BAR) {
+      Snp->PciIo->Mem.Read (
+                        Snp->PciIo,
+                        Width,
+                        Snp->MemoryBarIndex,  // BAR 0, Memory base address
+                        MemOrPortAddr,
+                        1,                    // count
+                        (VOID *) (UINTN) BufferPtr
+                        );
+    }
     break;
 
   case PXE_MEM_WRITE:
-    Snp->PciIo->Mem.Write (
-                      Snp->PciIo,
-                      Width,
-                      Snp->MemoryBarIndex,  // BAR 0, Memory base address
-                      MemOrPortAddr,
-                      1,                    // count
-                      (VOID *) (UINTN) BufferPtr
-                      );
+    ASSERT (Snp->MemoryBarIndex < PCI_MAX_BAR);
+    if (Snp->MemoryBarIndex < PCI_MAX_BAR) {
+      Snp->PciIo->Mem.Write (
+                        Snp->PciIo,
+                        Width,
+                        Snp->MemoryBarIndex,  // BAR 0, Memory base address
+                        MemOrPortAddr,
+                        1,                    // count
+                        (VOID *) (UINTN) BufferPtr
+                        );
+    }
     break;
   }
 
diff --git a/NetworkPkg/SnpDxe/Snp.c b/NetworkPkg/SnpDxe/Snp.c
index fe022e16ea..69e74132ed 100644
--- a/NetworkPkg/SnpDxe/Snp.c
+++ b/NetworkPkg/SnpDxe/Snp.c
@@ -466,8 +466,8 @@ SimpleNetworkDriverStart (
   // the IO BAR.  Save the index of the BAR into the adapter info structure.
   // for regular 32bit BARs, 0 is memory mapped, 1 is io mapped
   //
-  Snp->MemoryBarIndex = 0;
-  Snp->IoBarIndex     = 1;
+  Snp->MemoryBarIndex = PCI_MAX_BAR;
+  Snp->IoBarIndex     = PCI_MAX_BAR;
   FoundMemoryBar      = FALSE;
   FoundIoBar          = FALSE;
   for (BarIndex = 0; BarIndex < PCI_MAX_BAR; BarIndex++) {