lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 19 Jan 2022 12:37:37 -0600 From: Bjorn Helgaas <helgaas@...nel.org> To: Thomas Gleixner <tglx@...utronix.de> Cc: Marc Zyngier <maz@...nel.org>, Tong Zhang <ztong0001@...il.com>, Jason Gunthorpe <jgg@...pe.ca>, open list <linux-kernel@...r.kernel.org> Subject: Re: [PATCH] PCI/MSI: Prevent UAF in error path On Wed, Jan 19, 2022 at 06:54:52PM +0100, Thomas Gleixner wrote: > When the core MSI allocation fails, then the PCI/MSI code uses an already > freed MSI descriptor to unmask the MSI mask register in order to bring it back > into reset state. > > Remove MSI_FLAG_FREE_MSI_DESCS from the PCI/MSI irqdomain flags and let the > PCI/MSI code free the MSI descriptors after usage. > > Fixes: 0f62d941acf9 ("genirq/msi: Provide msi_domain_alloc/free_irqs_descs_locked()") > Reported-by: Tong Zhang <ztong0001@...il.com> > Signed-off-by: Thomas Gleixner <tglx@...utronix.de> Acked-by: Bjorn Helgaas <bhelgaas@...gle.com> What does "UAF" stand for? Ah, "use after free" I guess? Let me know if I should take this. Otherwise I assume it'll go whereever 0f62d941acf9 went. > --- > drivers/pci/msi/irqdomain.c | 4 ++-- > drivers/pci/msi/legacy.c | 1 - > 2 files changed, 2 insertions(+), 3 deletions(-) > > --- a/drivers/pci/msi/irqdomain.c > +++ b/drivers/pci/msi/irqdomain.c > @@ -28,6 +28,7 @@ void pci_msi_teardown_msi_irqs(struct pc > msi_domain_free_irqs_descs_locked(domain, &dev->dev); > else > pci_msi_legacy_teardown_msi_irqs(dev); > + msi_free_msi_descs(&dev->dev); > } > > /** > @@ -171,8 +172,7 @@ struct irq_domain *pci_msi_create_irq_do > if (info->flags & MSI_FLAG_USE_DEF_CHIP_OPS) > pci_msi_domain_update_chip_ops(info); > > - info->flags |= MSI_FLAG_ACTIVATE_EARLY | MSI_FLAG_DEV_SYSFS | > - MSI_FLAG_FREE_MSI_DESCS; > + info->flags |= MSI_FLAG_ACTIVATE_EARLY | MSI_FLAG_DEV_SYSFS; > if (IS_ENABLED(CONFIG_GENERIC_IRQ_RESERVATION_MODE)) > info->flags |= MSI_FLAG_MUST_REACTIVATE; > > --- a/drivers/pci/msi/legacy.c > +++ b/drivers/pci/msi/legacy.c > @@ -77,5 +77,4 @@ void pci_msi_legacy_teardown_msi_irqs(st > { > msi_device_destroy_sysfs(&dev->dev); > arch_teardown_msi_irqs(dev); > - msi_free_msi_descs(&dev->dev); > }
Powered by blists - more mailing lists