Re: [PATCH] PCI/MSI: Fix UAF in msi_capability_init

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Thomas,

This has been here for a while without fixing, I will respin V2 with
your proposed changes,
please let me know if I should add any tag by you.

Thanks,
Mostafa

On Tue, Apr 30, 2024 at 12:32 AM Mostafa Saleh <smostafa@xxxxxxxxxx> wrote:
>
> Hi Thomas,
>
> On Mon, Apr 29, 2024 at 11:04:39PM +0200, Thomas Gleixner wrote:
> > On Mon, Apr 29 2024 at 03:41, Mostafa Saleh wrote:
> > >  err:
> > > -   pci_msi_unmask(entry, msi_multi_mask(entry));
> > > +   /* Re-read the descriptor as it might have been freed */
> > > +   entry = msi_first_desc(&dev->dev, MSI_DESC_ALL);
> > > +   if (entry)
> > > +           pci_msi_unmask(entry, msi_multi_mask(entry));
> >
> > What unmasks the entry in the NULL case?
>
> Apparently nothing, I missed that. (PCI isn’t really my area, I
> prefer dealing with non standardised platform devices :))
>
> >
> > The mask has to be undone. So you need something like the uncompiled
> > below.
> >
> > Thanks,
> >
> >         tglx
> > ---
> >
> > --- a/drivers/pci/msi/msi.c
> > +++ b/drivers/pci/msi/msi.c
> > @@ -349,7 +349,7 @@ static int msi_capability_init(struct pc
> >                              struct irq_affinity *affd)
> >  {
> >       struct irq_affinity_desc *masks = NULL;
> > -     struct msi_desc *entry;
> > +     struct msi_desc *entry, desc;
> >       int ret;
> >
> >       /* Reject multi-MSI early on irq domain enabled architectures */
> > @@ -374,6 +374,12 @@ static int msi_capability_init(struct pc
> >       /* All MSIs are unmasked by default; mask them all */
> >       entry = msi_first_desc(&dev->dev, MSI_DESC_ALL);
> >       pci_msi_mask(entry, msi_multi_mask(entry));
> > +     /*
> > +      * Copy the MSI descriptor for the error path because
> > +      * pci_msi_setup_msi_irqs() will free it for the hierarchical
> > +      * interrupt domain case.
> > +      */
> > +     memcpy(&desc, entry, sizeof(desc));
> >
> >       /* Configure MSI capability structure */
> >       ret = pci_msi_setup_msi_irqs(dev, nvec, PCI_CAP_ID_MSI);
> > @@ -393,7 +399,7 @@ static int msi_capability_init(struct pc
> >       goto unlock;
> >
> >  err:
> > -     pci_msi_unmask(entry, msi_multi_mask(entry));
> > +     pci_msi_unmask(&desc, msi_multi_mask(&desc));
> >       pci_free_msi_irqs(dev);
> >  fail:
> >       dev->msi_enabled = 0;
>
> I tested it with my stub, but since I didn't write the code, here
> is my tag, let me know if you want me to respin.
>
> Tested-by: Mostafa Saleh <smostafa@xxxxxxxxxx>
>
> Thanks,
> Mostafa
>





[Index of Archives]     [DMA Engine]     [Linux Coverity]     [Linux USB]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Greybus]

  Powered by Linux