[Bug 207037] ixv driver uses uninitialized offset variable and writes into arbitrary pci config register

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=207037

            Bug ID: 207037
           Summary: ixv driver uses uninitialized offset variable and
                    writes into arbitrary pci config register
           Product: Base System
           Version: 11.0-CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: freebsd-bugs at FreeBSD.org
          Reporter: jlott at averesystems.com

Created attachment 166768
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=166768&action=edit
Patch to illustrate the problem

In the QEMU workaround code in if_ixv.c, the ixv driver calls pci_find_cap(dev,
PCIY_MSIX, &rid). It is not checking the return code from that function and the
function appears to always be failing. This then causes the driver to use the
rid variable uninitialized, which will mean setting a bit at an arbitrary
offset in pci config space. For now, this seems to have no adverse impact, but
it could easily cause very subtle problems. Also the QEMU workaround is
probably non-functional because of this.

I've attached a patch for a partial solution that checks the error code and
skips PCI write if it fails. This avoid the erroneous PCI accesses, but it
would be better if we could figure out why finding the capability is failing (I
have not debugged it that far).

-- 
You are receiving this mail because:
You are the assignee for the bug.