lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <87h7a28uhj.wl-maz@kernel.org> Date: Mon, 17 Jan 2022 11:36:08 +0000 From: Marc Zyngier <maz@...nel.org> To: Tong Zhang <ztong0001@...il.com> Cc: Thomas Gleixner <tglx@...utronix.de>, Jason Gunthorpe <jgg@...pe.ca>, open list <linux-kernel@...r.kernel.org> Subject: Re: [PATCH v1] genirq/msi: fix crash when handling Multi-MSI Please avoid top-posting. On Mon, 17 Jan 2022 10:10:13 +0000, Tong Zhang <ztong0001@...il.com> wrote: > > Hello, > > ops->msi_check could point to pci_msi_domain_check_cap that is the > function in question > > hence we can have following call stack > > pci_msi_domain_check_cap (used by ops->msi_check(domain, info, dev)) > msi_domain_prepare_irqs > __msi_domain_alloc_irqs > msi_domain_alloc_irqs_descs_locked > > What I am suggesting is commit 0f62d941acf9 changed how this return > value is being handled and created a UAF OK, this makes more sense. But msi_domain_prepare_irqs() shouldn't fail in this case, and we should proceed with the allocation of at least one vector, which isn't happening here. Also, if __msi_domain_alloc_irqs() is supposed to return the number of irqs allocated, it isn't doing it consistently. Thomas, can you shed some light on what is the intended behaviour here? Thanks, M. -- Without deviation from the norm, progress is not possible.
Powered by blists - more mailing lists