linux-kernel - Re: [PATCH v1] genirq/msi: fix crash when handling Multi-MSI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 17 Jan 2022 11:36:08 +0000
From:   Marc Zyngier <maz@...nel.org>
To:     Tong Zhang <ztong0001@...il.com>
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        Jason Gunthorpe <jgg@...pe.ca>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v1] genirq/msi: fix crash when handling Multi-MSI

Please avoid top-posting.

On Mon, 17 Jan 2022 10:10:13 +0000,
Tong Zhang <ztong0001@...il.com> wrote:
> 
> Hello,
> 
> ops->msi_check could point to pci_msi_domain_check_cap that is the
> function in question
> 
> hence we can have following call stack
> 
> pci_msi_domain_check_cap (used by ops->msi_check(domain, info, dev))
> msi_domain_prepare_irqs
> __msi_domain_alloc_irqs
> msi_domain_alloc_irqs_descs_locked
> 
> What I am suggesting is commit 0f62d941acf9 changed how this return
> value is being handled and created a UAF

OK, this makes more sense.

But msi_domain_prepare_irqs() shouldn't fail in this case, and we
should proceed with the allocation of at least one vector, which isn't
happening here.

Also, if __msi_domain_alloc_irqs() is supposed to return the number of
irqs allocated, it isn't doing it consistently.

Thomas, can you shed some light on what is the intended behaviour
here?

Thanks,

	M.

-- 
Without deviation from the norm, progress is not possible.