[src/trunk]: src/sys/dev/pci Don't follow an incorrect pointer in an extended...

[msaitoh <msaitoh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/2cd5cc985245
branches:  trunk
changeset: 347349:2cd5cc985245
user:      msaitoh <msaitoh%NetBSD.org@localhost>
date:      Mon Aug 22 08:35:42 2016 +0000

description:
Don't follow an incorrect pointer in an extended capability header. Tested
with Super Micro X10SDV-8C-TLN4F bus 255, device 12, function 0 (BIOS 1.1b).

diffstat:

 sys/dev/pci/pci_subr.c |  8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diffs (29 lines):

diff -r 4362d5990f6a -r 2cd5cc985245 sys/dev/pci/pci_subr.c
--- a/sys/dev/pci/pci_subr.c    Mon Aug 22 07:41:10 2016 +0000
+++ b/sys/dev/pci/pci_subr.c    Mon Aug 22 08:35:42 2016 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: pci_subr.c,v 1.149 2016/08/17 06:32:01 msaitoh Exp $   */
+/*     $NetBSD: pci_subr.c,v 1.150 2016/08/22 08:35:42 msaitoh Exp $   */
 
 /*
  * Copyright (c) 1997 Zubin D. Dittia.  All rights reserved.
@@ -40,7 +40,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: pci_subr.c,v 1.149 2016/08/17 06:32:01 msaitoh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: pci_subr.c,v 1.150 2016/08/22 08:35:42 msaitoh Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_pci.h"
@@ -3490,6 +3490,10 @@
                off = PCI_EXTCAPLIST_NEXT(rval);
                if (off == 0)
                        break;
+               else if (off <= PCI_CONF_SIZE) {
+                       printf("    next pointer: 0x%03x (incorrect)\n", off);
+                       return;
+               }
                rval = regs[o2i(off)];
        }