linux-kernel - [PATCH v2] PCI: endpoint: pci-epf-test: Fix double free Oops

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250124123043.96112-1-christian.bruel@foss.st.com>
Date: Fri, 24 Jan 2025 13:30:43 +0100
From: Christian Bruel <christian.bruel@...s.st.com>
To: <manivannan.sadhasivam@...aro.org>, <kw@...ux.com>, <kishon@...nel.org>,
        <bhelgaas@...gle.com>, <cassel@...nel.org>, <Frank.Li@....com>,
        <dlemoal@...nel.org>, <fabrice.gasnier@...s.st.com>
CC: <linux-pci@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        Christian
 Bruel <christian.bruel@...s.st.com>
Subject: [PATCH v2] PCI: endpoint: pci-epf-test: Fix double free Oops

Fixes an oops found while testing the stm32_pcie ep driver with handling
of PERST# deassertion:

During EP initialization, pci_epf_test_alloc_space allocates all BARs,
which are further freed if epc_set_bar fails (for instance, due to
no free inbound window).

However, when pci_epc_set_bar fails, the error path:
     pci_epc_set_bar -> pci_epf_free_space
does not reset epf_test->reg[bar].

Then, if the host reboots, PERST# deassertion restarts the BAR allocation
sequence with the same allocation failure (no free inbound window),
creating a double free situation since epf_test->reg[bar] was deallocated
and is still non-NULL.

Make sure that pci_epf_alloc_space/pci_epf_free_space are symmetric
by resetting epf_test->reg[bar] when memory is deallocated.

Reviewed-by: Niklas Cassel <cassel@...nel.org>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>
Signed-off-by: Christian Bruel <christian.bruel@...s.st.com>
---
v2: Cleanup commit message after Niklas comments and add Reviewed-by
---
 drivers/pci/endpoint/functions/pci-epf-test.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
index ffb534a8e50a..b29e938ee16a 100644
--- a/drivers/pci/endpoint/functions/pci-epf-test.c
+++ b/drivers/pci/endpoint/functions/pci-epf-test.c
@@ -718,6 +718,7 @@ static int pci_epf_test_set_bar(struct pci_epf *epf)
 		if (ret) {
 			pci_epf_free_space(epf, epf_test->reg[bar], bar,
 					   PRIMARY_INTERFACE);
+			epf_test->reg[bar] = NULL;
 			dev_err(dev, "Failed to set BAR%d\n", bar);
 			if (bar == test_reg_bar)
 				return ret;
@@ -909,6 +910,7 @@ static void pci_epf_test_free_space(struct pci_epf *epf)
 
 		pci_epf_free_space(epf, epf_test->reg[bar], bar,
 				   PRIMARY_INTERFACE);
+		epf_test->reg[bar] = NULL;
 	}
 }
 
-- 
2.34.1