PCI: Avoid iterating through memory outside the resource window

If the 'image' pointer has been advanced more than 'size', we've already
iterated through memory outside the resource window.

We have zero control over whatever we find in the option ROM, if it's even
an option ROM and not just an accident of random data just happening to
look like an option ROM.

Signed-off-by: Edward O'Callaghan <eocallaghan@alterapraxis.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>

diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
index eb0ad530dc430268ea699891fff5a64d6a38545a..45987adb9eaef39df4968825249b27e087d71271 100644 (file)
--- a/drivers/pci/rom.c
+++ b/drivers/pci/rom.c
@@ -96,6 +96,9 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
                last_image = readb(pds + 21) & 0x80;
                length = readw(pds + 16);
                image += length * 512;
+               /* Avoid iterating through memory outside the resource window */
+               if (image > rom + size)
+                       break;
        } while (length && !last_image);
 
        /* never return a size larger than the PCI resource window */