linux-kernel - Re: [PATCH] PCI: xgene-msi: Fix a potential UAF in xgene_msi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <23c09050.48ec5.18ae584a39d.Coremail.dinghao.liu@zju.edu.cn>
Date:   Sat, 30 Sep 2023 17:56:29 +0800 (GMT+08:00)
From:   dinghao.liu@....edu.cn
To:     "Marc Zyngier" <maz@...nel.org>
Cc:     "Toan Le" <toan@...amperecomputing.com>,
        "Lorenzo Pieralisi" <lpieralisi@...nel.org>,
        Krzysztof Wilczyński <kw@...ux.com>,
        "Rob Herring" <robh@...nel.org>,
        "Bjorn Helgaas" <bhelgaas@...gle.com>, "Duc Dang" <dhdang@....com>,
        "Tanmay Inamdar" <tinamdar@....com>, linux-pci@...r.kernel.org,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] PCI: xgene-msi: Fix a potential UAF in xgene_msi_probe

> On Tue, 26 Sep 2023 03:59:36 +0100,
> Dinghao Liu <dinghao.liu@....edu.cn> wrote:
> > 
> > xgene_allocate_domains() will call irq_domain_remove() to free
> > msi->inner_domain on failure. However, its caller, xgene_msi_probe(),
> > will also call irq_domain_remove() through xgene_msi_remove() on the
> > same failure, which may lead to a use-after-free. Remove the first
> > irq_domain_remove() and let xgene_free_domains() cleanup domains.
> > 
> > Fixes: dcd19de36775 ("PCI: xgene: Add APM X-Gene v1 PCIe MSI/MSIX termination driver")
> > Signed-off-by: Dinghao Liu <dinghao.liu@....edu.cn>
> > ---
> > 
> > Changelog:
> > 
> > v2: -Remove irq_domain_remove() instead of nulling msi_domain.
> 
> Unfortunately, your email doesn't indicate this is v2.

Sorry, my mistake. I will resend a new patch soon.

Regards,
Dinghao