Message-ID: <2025120453-CVE-2025-40219-01f2@gregkh>
Date: Thu,  4 Dec 2025 15:50:53 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-40219: PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV

Before disabling SR-IOV via config space accesses to the parent PF,
sriov_disable() first removes the PCI devices representing the VFs.

Since commit 9d16947b7583 ("PCI: Add global pci_lock_rescan_remove()")
such removal operations are serialized against concurrent remove and
rescan using the pci_rescan_remove_lock. No such locking was ever added
in sriov_disable() however. In particular when commit 18f9e9d150fc
("PCI/IOV: Factor out sriov_add_vfs()") factored out the PCI device
removal into sriov_del_vfs() there was still no locking around the
pci_iov_remove_virtfn() calls.

On s390 the lack of serialization in sriov_disable() may cause double
remove and list corruption with the below (amended) trace being observed:

  PSW:  0704c00180000000 0000000c914e4b38 (klist_put+56)
  GPRS: 000003800313fb48 0000000000000000 0000000100000001 0000000000000001
	00000000f9b520a8 0000000000000000 0000000000002fbd 00000000f4cc9480
	0000000000000001 0000000000000000 0000000000000000 0000000180692828
	00000000818e8000 000003800313fe2c 000003800313fb20 000003800313fad8
  #0 [3800313fb20] device_del at c9158ad5c
  #1 [3800313fb88] pci_remove_bus_device at c915105ba
  #2 [3800313fbd0] pci_iov_remove_virtfn at c9152f198
  #3 [3800313fc28] zpci_iov_remove_virtfn at c90fb67c0
  #4 [3800313fc60] zpci_bus_remove_device at c90fb6104
  #5 [3800313fca0] __zpci_event_availability at c90fb3dca
  #6 [3800313fd08] chsc_process_sei_nt0 at c918fe4a2
  #7 [3800313fd60] crw_collect_info at c91905822
  #8 [3800313fe10] kthread at c90feb390
  #9 [3800313fe68] __ret_from_fork at c90f6aa64
  #10 [3800313fe98] ret_from_fork at c9194f3f2.

This is because in addition to sriov_disable() removing the VFs, the
platform also generates hot-unplug events for the VFs. This being the
reverse operation to the hotplug events generated by sriov_enable() and
handled via pdev->no_vf_scan. And while the event processing takes
pci_rescan_remove_lock and checks whether the struct pci_dev still exists,
the lack of synchronization makes this checking racy.

Other races may also be possible of course though given that this lack of
locking persisted so long observable races seem very rare. Even on s390 the
list corruption was only observed with certain devices since the platform
events are only triggered by config accesses after the removal, so as long
as the removal finished synchronously they would not race. Either way the
locking is missing so fix this by adding it to the sriov_del_vfs() helper.

Just like PCI rescan-remove, locking is also missing in sriov_add_vfs()
including for the error case where pci_stop_and_remove_bus_device() is
called without the PCI rescan-remove lock being held. Even in the non-error
case, adding new PCI devices and buses should be serialized via the PCI
rescan-remove lock. Add the necessary locking.

The Linux kernel CVE team has assigned CVE-2025-40219 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.0 with commit 18f9e9d150fccfa747875df6f0a9f606740762b3 and fixed in 5.4.301 with commit 5c1cd7d405e94dc6cb320cc0cc092b74895b6ddf
	Issue introduced in 5.0 with commit 18f9e9d150fccfa747875df6f0a9f606740762b3 and fixed in 5.10.246 with commit 1e8a80290f964bdbad225221c8a1594c7e01c8fd
	Issue introduced in 5.0 with commit 18f9e9d150fccfa747875df6f0a9f606740762b3 and fixed in 5.15.195 with commit a645ca21de09e3137cbb224fa6c23cca873a1d01
	Issue introduced in 5.0 with commit 18f9e9d150fccfa747875df6f0a9f606740762b3 and fixed in 6.1.157 with commit a24219172456f035d886857e265ca24c85b167c8
	Issue introduced in 5.0 with commit 18f9e9d150fccfa747875df6f0a9f606740762b3 and fixed in 6.6.113 with commit 36039348bca77828bf06eae41b8f76e38cd15847
	Issue introduced in 5.0 with commit 18f9e9d150fccfa747875df6f0a9f606740762b3 and fixed in 6.12.54 with commit 53154cd40ccf285f1d1c24367824082061d155bd
	Issue introduced in 5.0 with commit 18f9e9d150fccfa747875df6f0a9f606740762b3 and fixed in 6.17.4 with commit ee40e5db052d7c6f406fdb95ad639c894c74674c
	Issue introduced in 5.0 with commit 18f9e9d150fccfa747875df6f0a9f606740762b3 and fixed in 6.18 with commit 05703271c3cdcc0f2a8cf6ebdc45892b8ca83520

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-40219
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/pci/iov.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/5c1cd7d405e94dc6cb320cc0cc092b74895b6ddf
	https://git.kernel.org/stable/c/1e8a80290f964bdbad225221c8a1594c7e01c8fd
	https://git.kernel.org/stable/c/a645ca21de09e3137cbb224fa6c23cca873a1d01
	https://git.kernel.org/stable/c/a24219172456f035d886857e265ca24c85b167c8
	https://git.kernel.org/stable/c/36039348bca77828bf06eae41b8f76e38cd15847
	https://git.kernel.org/stable/c/53154cd40ccf285f1d1c24367824082061d155bd
	https://git.kernel.org/stable/c/ee40e5db052d7c6f406fdb95ad639c894c74674c
	https://git.kernel.org/stable/c/05703271c3cdcc0f2a8cf6ebdc45892b8ca83520

Powered by blists - more mailing lists