linux-cve-announce - CVE-2024-46750: PCI: Add missing bridge lock to pci_bus

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024091838-CVE-2024-46750-3be1@gregkh>
Date: Wed, 18 Sep 2024 09:16:45 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-46750: PCI: Add missing bridge lock to pci_bus_lock()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

PCI: Add missing bridge lock to pci_bus_lock()

One of the true positives that the cfg_access_lock lockdep effort
identified is this sequence:

  WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pci_bridge_secondary_bus_reset+0x5d/0x70
  RIP: 0010:pci_bridge_secondary_bus_reset+0x5d/0x70
  Call Trace:
   <TASK>
   ? __warn+0x8c/0x190
   ? pci_bridge_secondary_bus_reset+0x5d/0x70
   ? report_bug+0x1f8/0x200
   ? handle_bug+0x3c/0x70
   ? exc_invalid_op+0x18/0x70
   ? asm_exc_invalid_op+0x1a/0x20
   ? pci_bridge_secondary_bus_reset+0x5d/0x70
   pci_reset_bus+0x1d8/0x270
   vmd_probe+0x778/0xa10
   pci_device_probe+0x95/0x120

Where pci_reset_bus() users are triggering unlocked secondary bus resets.
Ironically pci_bus_reset(), several calls down from pci_reset_bus(), uses
pci_bus_lock() before issuing the reset which locks everything *but* the
bridge itself.

For the same motivation as adding:

  bridge = pci_upstream_bridge(dev);
  if (bridge)
    pci_dev_lock(bridge);

to pci_reset_function() for the "bus" and "cxl_bus" reset cases, add
pci_dev_lock() for @bus->self to pci_bus_lock().

[bhelgaas: squash in recursive locking deadlock fix from Keith Busch:
https://lore.kernel.org/r/20240711193650.701834-1-kbusch@meta.com]

The Linux kernel CVE team has assigned CVE-2024-46750 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.19.322 with commit 0790b89c7e91
	Fixed in 5.4.284 with commit df77a678c338
	Fixed in 5.10.226 with commit e2355d513b89
	Fixed in 5.15.167 with commit 04e85a3285b0
	Fixed in 6.1.110 with commit 7253b4fed464
	Fixed in 6.6.51 with commit 78c6e39fef5c
	Fixed in 6.10.10 with commit 81c68e218ab8
	Fixed in 6.11 with commit a4e772898f8b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-46750
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/pci/pci.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/0790b89c7e911003b8c50ae50e3ac7645de1fae9
	https://git.kernel.org/stable/c/df77a678c33871a6e4ac5b54a71662f1d702335b
	https://git.kernel.org/stable/c/e2355d513b89a2cb511b4ded0deb426cdb01acd0
	https://git.kernel.org/stable/c/04e85a3285b0e5c5af6fd2c0fd6e95ffecc01945
	https://git.kernel.org/stable/c/7253b4fed46471cc247c6cacefac890a8472c083
	https://git.kernel.org/stable/c/78c6e39fef5c428960aff742149bba302dd46f5a
	https://git.kernel.org/stable/c/81c68e218ab883dfa368460a59b674084c0240da
	https://git.kernel.org/stable/c/a4e772898f8bf2e7e1cf661a12c60a5612c4afab