https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=207037
Bug ID: 207037
Summary: ixv driver uses uninitialized offset variable and
writes into arbitrary pci config register
Product: Base System
Version: 11.0-CURRENT
Hardware: Any
OS: Any
Status: New
Severity: Affects Only Me
Priority: ---
Component: kern
Assignee: [email protected]
Reporter: [email protected]
Created attachment 166768
--> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=166768&action=edit
Patch to illustrate the problem
In the QEMU workaround code in if_ixv.c, the ixv driver calls pci_find_cap(dev,
PCIY_MSIX, &rid). It is not checking the return code from that function and the
function appears to always be failing. This then causes the driver to use the
rid variable uninitialized, which will mean setting a bit at an arbitrary
offset in pci config space. For now, this seems to have no adverse impact, but
it could easily cause very subtle problems. Also the QEMU workaround is
probably non-functional because of this.
I've attached a patch for a partial solution that checks the error code and
skips PCI write if it fails. This avoid the erroneous PCI accesses, but it
would be better if we could figure out why finding the capability is failing (I
have not debugged it that far).
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "[email protected]"
