summaryrefslogtreecommitdiff
path: root/drivers/pci/rom.c
diff options
context:
space:
mode:
authorRex Zhu <Rex.Zhu@amd.com>2018-06-05 04:46:45 +0300
committerBjorn Helgaas <bhelgaas@google.com>2018-06-30 05:07:17 +0300
commit445ec321e71b3124abacfb358f72ac6a70d87602 (patch)
treeacbecd71b968ec0667bcebed2652d5111edc8e5e /drivers/pci/rom.c
parent11eb0e0e8dea8b97cff972b09cf6fb033b729dff (diff)
downloadlinux-445ec321e71b3124abacfb358f72ac6a70d87602.tar.xz
PCI: Avoid accessing memory outside the ROM BAR
pci_get_rom_size() accepts the base and size of the ROM BAR as arguments. The byte at "rom + size" is the first byte *past* the ROM, so change ">" to ">=" to avoid accessing beyond the actual length of the ROM BAR. Signed-off-by: Rex Zhu <Rex.Zhu@amd.com> [bhelgaas: changelog] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/pci/rom.c')
-rw-r--r--drivers/pci/rom.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
index a7b5c37a85ec..946795fc0071 100644
--- a/drivers/pci/rom.c
+++ b/drivers/pci/rom.c
@@ -106,7 +106,7 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
length = readw(pds + 16);
image += length * 512;
/* Avoid iterating through memory outside the resource window */
- if (image > rom + size)
+ if (image >= rom + size)
break;
} while (length && !last_image);