Repository navigation
[virtio] Fix MSI-X caps control register offset in legacy fallback mode - #1857
Merged
Merged
Conversation
In legacy mode when checking if MSI-X is enabled to calculate the device-specific region offset, the code accesses the base of the MSI-X capability structure instead of the Message Control register and, if the Next Pointer value exceeds 0x80, the subsequent check of PCI_MSIX_CTRL_ENABLE mask incorrectly evaluates to true. This false positive forces an erroneous 24-byte base offset, shifting subsequent configuration reads by 4 bytes. This manifests as a mangled MAC address during device probe (e.g. 34:56:01:00:ff:ff). Fix the read offset to target the Message Control register. Reported-by: Kent Konishi <konishi.kento@fujitsu.com> Signed-off-by: Dario Faggioli <dfaggioli@suse.com> Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
Member
|
Good catch, thank you |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In fallback mode when checking if MSI-X is enabled to calculate the device-specific region offset, the code accesses the base of the MSI-X capability structure instead of the Message Control register and, if the Next Pointer value exceeds 0x80, the subsequent check of PCI_MSIX_CTRL_ENABLE mask incorrectly evaluates to true.
This false positive forces an erroneous 24-byte base offset, shifting subsequent configuration reads by 4 bytes. This manifests as a mangled MAC address during device probe (e.g. reading 34:56:01:00:ff:ff).
Fix the read offset to target the Message Control register.
Reported-by: Kent Konishi konishi.kento@fujitsu.com
References: https://bugzilla.suse.com/show_bug.cgi?id=1271200