linux_dsm_epyc7002/drivers/pci
Lukas Wunner 281e878eab PCI: pciehp: Fix use-after-free on unplug
When pciehp is unbound (e.g. on unplug of a Thunderbolt device), the
hotplug_slot struct is deregistered and thus freed before freeing the
IRQ.  The IRQ handler and the work items it schedules print the slot
name referenced from the freed structure in various informational and
debug log messages, each time resulting in a quadruple dereference of
freed pointers (hotplug_slot -> pci_slot -> kobject -> name).

At best the slot name is logged as "(null)", at worst kernel memory is
exposed in logs or the driver crashes:

  pciehp 0000:10:00.0:pcie204: Slot((null)): Card not present

An attacker may provoke the bug by unplugging multiple devices on a
Thunderbolt daisy chain at once.  Unplugging can also be simulated by
powering down slots via sysfs.  The bug is particularly easy to trigger
in poll mode.

It has been present since the driver's introduction in 2004:
https://git.kernel.org/tglx/history/c/c16b4b14d980

Fix by rearranging teardown such that the IRQ is freed first.  Run the
work items queued by the IRQ handler to completion before freeing the
hotplug_slot struct by draining the work queue from the ->release_slot
callback which is invoked by pci_hp_deregister().

Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org # v2.6.4
2018-07-23 17:04:10 -05:00
..
controller - Error path bug fix for overflow tests (Dan) 2018-06-12 18:28:00 -07:00
endpoint Merge branch 'lorenzo/pci/endpoint' 2018-06-06 16:10:30 -05:00
hotplug PCI: pciehp: Fix use-after-free on unplug 2018-07-23 17:04:10 -05:00
pcie PCI/AER: Use "PCI Express" consistently in Kconfig text 2018-06-11 08:11:47 -05:00
switch vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
access.c Merge branch 'pci/vpd' 2018-04-04 13:28:40 -05:00
ats.c PCI: Add "pci=noats" boot parameter 2018-05-10 17:56:02 -05:00
bus.c PCI: remove CONFIG_PCI_BUS_ADDR_T_64BIT 2018-05-09 06:57:18 +02:00
ecam.c PCI: Add SPDX GPL-2.0 to replace GPL v2 boilerplate 2018-01-28 15:48:29 -06:00
host-bridge.c PCI: Tidy comments 2018-03-19 14:20:43 -05:00
iov.c PCI/IOV: Allow PF drivers to limit total_VFs to 0 2018-05-25 08:18:34 -05:00
irq.c PCI: Add wrappers for dev_printk() 2018-01-18 12:55:24 -06:00
Kconfig PCI: Collect all native drivers under drivers/pci/controller/ 2018-06-08 07:50:11 -05:00
Makefile PCI: Collect all native drivers under drivers/pci/controller/ 2018-06-08 07:50:11 -05:00
mmap.c PCI: Tidy comments 2018-03-19 14:20:43 -05:00
msi.c treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
of.c PCI: Rework of_pci_get_host_bridge_resources() to devm_of_pci_get_host_bridge_resources() 2018-05-30 11:35:13 -05:00
pci-acpi.c PCI: shpchp: Separate existence of SHPC and permission to use it 2018-06-26 15:38:28 -05:00
pci-driver.c pci-v4.18-changes 2018-06-07 12:45:58 -07:00
pci-label.c PCI: Tidy comments 2018-03-19 14:20:43 -05:00
pci-mid.c PCI: Add SPDX GPL-2.0 to replace GPL v2 boilerplate 2018-01-28 15:48:29 -06:00
pci-pf-stub.c PCI/IOV: Add pci-pf-stub driver for PFs that only enable VFs 2018-04-24 16:47:16 -05:00
pci-stub.c PCI: Tidy comments 2018-03-19 14:20:43 -05:00
pci-sysfs.c treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
pci.c pci-v4.18-changes 2018-06-07 12:45:58 -07:00
pci.h Merge branch 'lorenzo/pci/dwc' 2018-06-06 16:10:27 -05:00
probe.c Merge branch 'pci/resource' 2018-06-06 16:10:18 -05:00
proc.c proc: introduce proc_create_seq{,_data} 2018-05-16 07:23:35 +02:00
quirks.c Merge branch 'pci/trivial' 2018-06-06 16:10:51 -05:00
remove.c PCI: Add SPDX GPL-2.0 when no license was specified 2018-01-26 11:45:16 -06:00
rom.c PCI: Tidy comments 2018-03-19 14:20:43 -05:00
search.c PCI: Tidy comments 2018-03-19 14:20:43 -05:00
setup-bus.c PCI: Move resource distribution for single bridge outside loop 2018-06-04 12:08:06 -05:00
setup-irq.c PCI: Tidy comments 2018-03-19 14:20:43 -05:00
setup-res.c PCI: Remove messages about reassigning resources 2018-04-11 08:46:50 -05:00
slot.c Merge branch 'pci/misc' 2018-04-04 13:27:45 -05:00
syscall.c PCI: Tidy comments 2018-03-19 14:20:43 -05:00
vc.c Merge branch 'pci/spdx' into next 2018-02-01 11:40:07 -06:00
vpd.c pci-v4.17-changes 2018-04-06 18:31:06 -07:00
xen-pcifront.c PCI: Tidy comments 2018-03-19 14:20:43 -05:00