From: Mostafa Saleh <smostafa@google.com>
To: Thomas Gleixner <tglx@linutronix.de>
Cc: bhelgaas@google.com, linux-pci@vger.kernel.org,
linux-kernel@vger.kernel.org, ilpo.jarvinen@linux.intel.com,
kernel-team@android.com
Subject: Re: [PATCH] PCI/MSI: Fix UAF in msi_capability_init
Date: Mon, 29 Apr 2024 23:32:53 +0000 [thread overview]
Message-ID: <ZjAuJV87RjOu7gSy@google.com> (raw)
In-Reply-To: <87zftbswwo.ffs@tglx>
Hi Thomas,
On Mon, Apr 29, 2024 at 11:04:39PM +0200, Thomas Gleixner wrote:
> On Mon, Apr 29 2024 at 03:41, Mostafa Saleh wrote:
> > err:
> > - pci_msi_unmask(entry, msi_multi_mask(entry));
> > + /* Re-read the descriptor as it might have been freed */
> > + entry = msi_first_desc(&dev->dev, MSI_DESC_ALL);
> > + if (entry)
> > + pci_msi_unmask(entry, msi_multi_mask(entry));
>
> What unmasks the entry in the NULL case?
Apparently nothing, I missed that. (PCI isn’t really my area, I
prefer dealing with non standardised platform devices :))
>
> The mask has to be undone. So you need something like the uncompiled
> below.
>
> Thanks,
>
> tglx
> ---
>
> --- a/drivers/pci/msi/msi.c
> +++ b/drivers/pci/msi/msi.c
> @@ -349,7 +349,7 @@ static int msi_capability_init(struct pc
> struct irq_affinity *affd)
> {
> struct irq_affinity_desc *masks = NULL;
> - struct msi_desc *entry;
> + struct msi_desc *entry, desc;
> int ret;
>
> /* Reject multi-MSI early on irq domain enabled architectures */
> @@ -374,6 +374,12 @@ static int msi_capability_init(struct pc
> /* All MSIs are unmasked by default; mask them all */
> entry = msi_first_desc(&dev->dev, MSI_DESC_ALL);
> pci_msi_mask(entry, msi_multi_mask(entry));
> + /*
> + * Copy the MSI descriptor for the error path because
> + * pci_msi_setup_msi_irqs() will free it for the hierarchical
> + * interrupt domain case.
> + */
> + memcpy(&desc, entry, sizeof(desc));
>
> /* Configure MSI capability structure */
> ret = pci_msi_setup_msi_irqs(dev, nvec, PCI_CAP_ID_MSI);
> @@ -393,7 +399,7 @@ static int msi_capability_init(struct pc
> goto unlock;
>
> err:
> - pci_msi_unmask(entry, msi_multi_mask(entry));
> + pci_msi_unmask(&desc, msi_multi_mask(&desc));
> pci_free_msi_irqs(dev);
> fail:
> dev->msi_enabled = 0;
I tested it with my stub, but since I didn't write the code, here
is my tag, let me know if you want me to respin.
Tested-by: Mostafa Saleh <smostafa@google.com>
Thanks,
Mostafa
prev parent reply other threads:[~2024-04-29 23:32 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-29 3:41 [PATCH] PCI/MSI: Fix UAF in msi_capability_init Mostafa Saleh
2024-04-29 21:04 ` Thomas Gleixner
2024-04-29 23:32 ` Mostafa Saleh [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZjAuJV87RjOu7gSy@google.com \
--to=smostafa@google.com \
--cc=bhelgaas@google.com \
--cc=ilpo.jarvinen@linux.intel.com \
--cc=kernel-team@android.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).