Messages in this thread | | | From | Tong Zhang <> | Date | Wed, 19 Jan 2022 10:54:53 -0800 | Subject | Re: [PATCH] PCI/MSI: Prevent UAF in error path |
| |
On Wed, Jan 19, 2022 at 9:54 AM Thomas Gleixner <tglx@linutronix.de> wrote: > > When the core MSI allocation fails, then the PCI/MSI code uses an already > freed MSI descriptor to unmask the MSI mask register in order to bring it back > into reset state. > > Remove MSI_FLAG_FREE_MSI_DESCS from the PCI/MSI irqdomain flags and let the > PCI/MSI code free the MSI descriptors after usage. > > Fixes: 0f62d941acf9 ("genirq/msi: Provide msi_domain_alloc/free_irqs_descs_locked()") > Reported-by: Tong Zhang <ztong0001@gmail.com> > Signed-off-by: Thomas Gleixner <tglx@linutronix.de> > --- > drivers/pci/msi/irqdomain.c | 4 ++-- > drivers/pci/msi/legacy.c | 1 - > 2 files changed, 2 insertions(+), 3 deletions(-) > > --- a/drivers/pci/msi/irqdomain.c > +++ b/drivers/pci/msi/irqdomain.c > @@ -28,6 +28,7 @@ void pci_msi_teardown_msi_irqs(struct pc > msi_domain_free_irqs_descs_locked(domain, &dev->dev); > else > pci_msi_legacy_teardown_msi_irqs(dev); > + msi_free_msi_descs(&dev->dev); > } > > /** > @@ -171,8 +172,7 @@ struct irq_domain *pci_msi_create_irq_do > if (info->flags & MSI_FLAG_USE_DEF_CHIP_OPS) > pci_msi_domain_update_chip_ops(info); > > - info->flags |= MSI_FLAG_ACTIVATE_EARLY | MSI_FLAG_DEV_SYSFS | > - MSI_FLAG_FREE_MSI_DESCS; > + info->flags |= MSI_FLAG_ACTIVATE_EARLY | MSI_FLAG_DEV_SYSFS; > if (IS_ENABLED(CONFIG_GENERIC_IRQ_RESERVATION_MODE)) > info->flags |= MSI_FLAG_MUST_REACTIVATE; > > --- a/drivers/pci/msi/legacy.c > +++ b/drivers/pci/msi/legacy.c > @@ -77,5 +77,4 @@ void pci_msi_legacy_teardown_msi_irqs(st > { > msi_device_destroy_sysfs(&dev->dev); > arch_teardown_msi_irqs(dev); > - msi_free_msi_descs(&dev->dev); > }
Tested-by: Tong Zhang <ztong0001@gmail.com>
Tested on my setup, it no longer crashes. Thanks! - Tong
| |