Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: [PATCH] vfio/pci: Sanity check IGD OpRegion Size
From:   Alex Williamson <alex.williamson@redhat.com>
To:     alex.williamson@redhat.com
Cc:     tkffaul@outlook.com, kvm@vger.kernel.org,
        linux-kernel@vger.kernel.org
Date:   Fri, 07 May 2021 12:53:17 -0600
Message-ID: <162041357421.21800.16214130780777455390.stgit@omen>
User-Agent: StGit/1.0-8-g6af9-dirty
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Precedence: bulk

The size field of the IGD OpRegion table is supposed to indicate table
size in KB, but we've seen at least one report of a BIOS that appears
to incorrectly report size in bytes.  The default size is 8 (*1024 =
8KB), but an incorrect implementation may report 8192 (*1024 = 8MB)
and can cause a variety of mapping errors.

It's believed that 8MB would be an implausible, if not absurd, actual
size, so we can probably be pretty safe in assuming this is a BIOS bug
where the intended size is likely 8KB.

Reported-by: Travis Faulhaber <tkffaul@outlook.com>
Tested-by: Travis Faulhaber <tkffaul@outlook.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
---
 drivers/vfio/pci/vfio_pci_igd.c |   11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/vfio/pci/vfio_pci_igd.c b/drivers/vfio/pci/vfio_pci_igd.c
index 228df565e9bc..c89a4797cd18 100644
--- a/drivers/vfio/pci/vfio_pci_igd.c
+++ b/drivers/vfio/pci/vfio_pci_igd.c
@@ -86,7 +86,16 @@ static int vfio_pci_igd_opregion_init(struct vfio_pci_device *vdev)
 		return -EINVAL;
 	}
 
-	size *= 1024; /* In KB */
+	/*
+	 * The OpRegion size field is specified as size in KB, but there have been
+	 * user reports where this field appears to report size in bytes.  If we
+	 * read 8192, assume this is the case.
+	 */
+	if (size == OPREGION_SIZE)
+		pci_warn(vdev->pdev,
+			 "BIOS Bug, IGD OpRegion reports invalid size, assuming default 8KB\n");
+	else
+		size *= 1024; /* In KB */
 
 	/*
 	 * Support opregion v2.1+