linux-kernel - Re: [PATCH] PCI/MSI: Fix UAF in msi_capability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 22 Jun 2024 19:53:14 +0100
From: Mostafa Saleh <smostafa@...gle.com>
To: Thomas Gleixner <tglx@...utronix.de>
Cc: bhelgaas@...gle.com, linux-pci@...r.kernel.org, 
	linux-kernel@...r.kernel.org, ilpo.jarvinen@...ux.intel.com, 
	kernel-team@...roid.com
Subject: Re: [PATCH] PCI/MSI: Fix UAF in msi_capability_init

Hi Thomas,

This has been here for a while without fixing, I will respin V2 with
your proposed changes,
please let me know if I should add any tag by you.

Thanks,
Mostafa

On Tue, Apr 30, 2024 at 12:32 AM Mostafa Saleh <smostafa@...gle.com> wrote:
>
> Hi Thomas,
>
> On Mon, Apr 29, 2024 at 11:04:39PM +0200, Thomas Gleixner wrote:
> > On Mon, Apr 29 2024 at 03:41, Mostafa Saleh wrote:
> > >  err:
> > > -   pci_msi_unmask(entry, msi_multi_mask(entry));
> > > +   /* Re-read the descriptor as it might have been freed */
> > > +   entry = msi_first_desc(&dev->dev, MSI_DESC_ALL);
> > > +   if (entry)
> > > +           pci_msi_unmask(entry, msi_multi_mask(entry));
> >
> > What unmasks the entry in the NULL case?
>
> Apparently nothing, I missed that. (PCI isn’t really my area, I
> prefer dealing with non standardised platform devices :))
>
> >
> > The mask has to be undone. So you need something like the uncompiled
> > below.
> >
> > Thanks,
> >
> >         tglx
> > ---
> >
> > --- a/drivers/pci/msi/msi.c
> > +++ b/drivers/pci/msi/msi.c
> > @@ -349,7 +349,7 @@ static int msi_capability_init(struct pc
> >                              struct irq_affinity *affd)
> >  {
> >       struct irq_affinity_desc *masks = NULL;
> > -     struct msi_desc *entry;
> > +     struct msi_desc *entry, desc;
> >       int ret;
> >
> >       /* Reject multi-MSI early on irq domain enabled architectures */
> > @@ -374,6 +374,12 @@ static int msi_capability_init(struct pc
> >       /* All MSIs are unmasked by default; mask them all */
> >       entry = msi_first_desc(&dev->dev, MSI_DESC_ALL);
> >       pci_msi_mask(entry, msi_multi_mask(entry));
> > +     /*
> > +      * Copy the MSI descriptor for the error path because
> > +      * pci_msi_setup_msi_irqs() will free it for the hierarchical
> > +      * interrupt domain case.
> > +      */
> > +     memcpy(&desc, entry, sizeof(desc));
> >
> >       /* Configure MSI capability structure */
> >       ret = pci_msi_setup_msi_irqs(dev, nvec, PCI_CAP_ID_MSI);
> > @@ -393,7 +399,7 @@ static int msi_capability_init(struct pc
> >       goto unlock;
> >
> >  err:
> > -     pci_msi_unmask(entry, msi_multi_mask(entry));
> > +     pci_msi_unmask(&desc, msi_multi_mask(&desc));
> >       pci_free_msi_irqs(dev);
> >  fail:
> >       dev->msi_enabled = 0;
>
> I tested it with my stub, but since I didn't write the code, here
> is my tag, let me know if you want me to respin.
>
> Tested-by: Mostafa Saleh <smostafa@...gle.com>
>
> Thanks,
> Mostafa
>