linux-kernel - [PATCH] pci: fix uaf for resource file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250629030547.1073425-1-zhangjian496@huawei.com>
Date: Sun, 29 Jun 2025 11:05:47 +0800
From: zhangjian <zhangjian496@...wei.com>
To: <lossin@...nel.org>, <aliceryhl@...gle.com>, <dakr@...nel.org>,
	<simona.vetter@...ll.ch>
CC: <linux-pci@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: [PATCH] pci: fix uaf for resource file

concurrently creating attr files may cause uaf. We meet this in concurrently
plug and unplug network card. For example:

echo 20 > /sys/class/net/eth3/device/sriov_numvfs &
echo 1 > /sys/bus/pci/rescan

crash log snips as following:

Call Trace:
 <TASK>
 ? _die_body+0x1a/0xe0
 ? page_fault_oops+0x81/0x150
 ? _wake_up_sync_key+0x37/0x50
 ? exc_page_fault+0x525/0x730
 ? asm_exc_page_fault+0x22/0x30
 ? pci_create_attr+0x160/0x180
 ? pfx_strlen+0x10/0x10
 kernfs_name_hash+0x12/0x80
 kernfs_find_ns+0x35/0xc0
 kernfs_remove_by_name_ns+0x46/0xc0
 pci_stop_bus_device+0x7c/0x90
 pci_stop_and_remole_bus_device+0xe/0x20
 pci_iov_remove_virtfn+0xbd/0x120
 sriov_disable+0x34/0xe0
 hinic_pci_sriov_diisable+0x35/0xa0 [hinic]
 hinic_remove+0x22e/0x2a0 [hinic]
 pci_device_remove+0x3b/0xb0
 device_release_driver_internal+0x19b/0x200
 pci_stop_bus_device+0x6c/0x90
 pci_stop_and_remolre_bus_device_locked+0x16/0x30
 remove_store+0xfc/0x130
 kernfs_fop_write_iter+0x11b/0x200

set resource pointer to zero to fix this problem.

Signed-off-by: zhangjian <zhangjian496@...wei.com>
---
 drivers/pci/pci-sysfs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 268c69daa..12dba9228 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -1180,12 +1180,14 @@ static void pci_remove_resource_files(struct pci_dev *pdev)
 		if (res_attr) {
 			sysfs_remove_bin_file(&pdev->dev.kobj, res_attr);
 			kfree(res_attr);
+			pdev->res_attr[i] = NULL;
 		}

 		res_attr = pdev->res_attr_wc[i];
 		if (res_attr) {
 			sysfs_remove_bin_file(&pdev->dev.kobj, res_attr);
 			kfree(res_attr);
+			pdev->res_attr_wc[i] = NULL;
 		}
 	}
 }
-- 
2.33.0