[PATCH 5/6] platform/x86/intel/pmt/discovery: Validate feature table against the BAR

[David E. Box]

For ACCESS_LOCAL features, the feature table resource is built from the
discovery table's offset and size fields, which are both read from the
device. The offset is a 32-bit value applied past the end of the discovery
region and the size is a 16-bit dword count, yet the resulting range is
never checked against the BAR the discovery table lives in. A malicious or
broken device can therefore direct the driver to map and read MMIO outside
of its BAR.

Use intel_vsec_check_bar_resource() to reject feature tables that do not
fit within the discovery BAR recorded by the vsec driver before mapping
them.

Fixes: d9a078809356 ("platform/x86/intel/pmt: Add PMT Discovery driver")
Signed-off-by: David E. Box <david.e.box@xxxxxxxxxxxxxxx>
---
 drivers/platform/x86/intel/pmt/discovery.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/x86/intel/pmt/discovery.c b/drivers/platform/x86/intel/pmt/discovery.c
index 24ba7211e59d..6717121dc6f2 100644
--- a/drivers/platform/x86/intel/pmt/discovery.c
+++ b/drivers/platform/x86/intel/pmt/discovery.c
@@ -376,6 +376,7 @@ static int
 pmt_feature_get_feature_table(struct pmt_features_priv *priv,
 			      struct feature *feature,
 			      struct feature_discovery_table *disc_tbl,
+			      struct intel_vsec_device *ivdev,
 			      struct resource *disc_res)
 {
 	struct feature_table *feat_tbl = &feature->table;
@@ -404,6 +405,10 @@ pmt_feature_get_feature_table(struct pmt_features_priv *priv,
 		 */
 		res = DEFINE_RES_MEM(disc_res->end + disc_tbl->offset + 1,
 				     disc_tbl->size * sizeof(u32));
+
+		if (intel_vsec_check_bar_resource(ivdev, ivdev->tbir, &res))
+			return dev_err_probe(priv->dev, -EINVAL,
+					     "Feature table %pR outside of BAR\n", &res);
 		break;
 
 	default:
@@ -494,7 +499,7 @@ static int pmt_features_discovery(struct pmt_features_priv *priv,
 	if (ret)
 		return ret;
 
-	ret = pmt_feature_get_feature_table(priv, feature, &disc_tbl, disc_res);
+	ret = pmt_feature_get_feature_table(priv, feature, &disc_tbl, ivdev, disc_res);
 	if (ret)
 		return ret;
 
@@ -653,3 +658,4 @@ MODULE_AUTHOR("David E. Box <david.e.box@xxxxxxxxxxxxxxx>");
 MODULE_DESCRIPTION("Intel PMT Discovery driver");
 MODULE_LICENSE("GPL");
 MODULE_IMPORT_NS("INTEL_PMT");
+MODULE_IMPORT_NS("INTEL_VSEC");
-- 
2.43.0