linux-kernel - Re: xhci_pci & PCIe hotplug crash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 5 May 2021 14:44:02 +0200
From:   Lukas Wunner <lukas@...ner.de>
To:     Pali Rohár <pali@...nel.org>
Cc:     Greg KH <gregkh@...uxfoundation.org>, linux-usb@...r.kernel.org,
        linux-pci@...r.kernel.org, linux-kernel@...r.kernel.org,
        Marek Behún <kabel@...nel.org>
Subject: Re: xhci_pci & PCIe hotplug crash

On Wed, May 05, 2021 at 02:33:46PM +0200, Pali Rohár wrote:
> I just spotted this crash during debugging PCIe controller driver
> pci-aardvark.c with trying to expose its link down events via "hot plug"
> interrupt and corresponding link layer state flags.
> 
> And because in whole call trace I see only generic PCIe and USB code
> path without any driver specific parts, I suspect that this is not PCIe
> controller-specific issue but rather something "wrong" in genetic PCIe
> (or USB) code. That is why I sent this email, so maybe somebody else
> find something suspicious here.
> 
> But still there is a chance that issue can be also in pci-aardvark.c
> driver and somehow it masked its issue and propagated it into generic
> PCIe hot plug code path.

If you hot-remove the XHCI controller, accesses to its MMIO space
will fail.  xhci_irq() seems to perform such MMIO accesses.

Normally this should happen silently and MMIO accesses just return
with a fabricated "all ones" response.  Chances are however that the
Aardvark controller raises a synchronous external abort instead.
Perhaps you can teach it not to do that.

Thanks,

Lukas