2023-09-26 03:01:20

by Dinghao Liu

Subject: [PATCH] PCI: xgene-msi: Fix a potential UAF in xgene_msi_probe

xgene_allocate_domains() will call irq_domain_remove() to free
msi->inner_domain on failure. However, its caller, xgene_msi_probe(),
will also call irq_domain_remove() through xgene_msi_remove() on the
same failure, which may lead to a use-after-free. Remove the first
irq_domain_remove() and let xgene_free_domains() cleanup domains.

Fixes: dcd19de36775 ("PCI: xgene: Add APM X-Gene v1 PCIe MSI/MSIX termination driver")
Signed-off-by: Dinghao Liu <[email protected]>
---

Changelog:

v2: -Remove irq_domain_remove() instead of nulling msi_domain.
---
drivers/pci/controller/pci-xgene-msi.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/pci/controller/pci-xgene-msi.c b/drivers/pci/controller/pci-xgene-msi.c
index 3ce38dfd0d29..0f9b9394399d 100644
--- a/drivers/pci/controller/pci-xgene-msi.c
+++ b/drivers/pci/controller/pci-xgene-msi.c
@@ -251,10 +251,8 @@ static int xgene_allocate_domains(struct xgene_msi *msi)
&xgene_msi_domain_info,
msi->inner_domain);

- if (!msi->msi_domain) {
- irq_domain_remove(msi->inner_domain);
+ if (!msi->msi_domain)
return -ENOMEM;
- }

return 0;
}
--
2.17.1

2023-09-29 09:44:10

by Marc Zyngier

Subject: Re: [PATCH] PCI: xgene-msi: Fix a potential UAF in xgene_msi_probe

On Tue, 26 Sep 2023 03:59:36 +0100,
Dinghao Liu <[email protected]> wrote:
>
> xgene_allocate_domains() will call irq_domain_remove() to free
> msi->inner_domain on failure. However, its caller, xgene_msi_probe(),
> will also call irq_domain_remove() through xgene_msi_remove() on the
> same failure, which may lead to a use-after-free. Remove the first
> irq_domain_remove() and let xgene_free_domains() cleanup domains.
>
> Fixes: dcd19de36775 ("PCI: xgene: Add APM X-Gene v1 PCIe MSI/MSIX termination driver")
> Signed-off-by: Dinghao Liu <[email protected]>
> ---
>
> Changelog:
>
> v2: -Remove irq_domain_remove() instead of nulling msi_domain.

Unfortunately, your email doesn't indicate this is v2.

M.

--
Without deviation from the norm, progress is not possible.

2023-09-30 09:57:21

by Dinghao Liu

Subject: Re: [PATCH] PCI: xgene-msi: Fix a potential UAF in xgene_msi_probe

> On Tue, 26 Sep 2023 03:59:36 +0100,
> Dinghao Liu <[email protected]> wrote:
> >
> > xgene_allocate_domains() will call irq_domain_remove() to free
> > msi->inner_domain on failure. However, its caller, xgene_msi_probe(),
> > will also call irq_domain_remove() through xgene_msi_remove() on the
> > same failure, which may lead to a use-after-free. Remove the first
> > irq_domain_remove() and let xgene_free_domains() cleanup domains.
> >
> > Fixes: dcd19de36775 ("PCI: xgene: Add APM X-Gene v1 PCIe MSI/MSIX termination driver")
> > Signed-off-by: Dinghao Liu <[email protected]>
> > ---
> >
> > Changelog:
> >
> > v2: -Remove irq_domain_remove() instead of nulling msi_domain.
>
> Unfortunately, your email doesn't indicate this is v2.

Sorry, my mistake. I will resend a new patch soon.

Regards,
Dinghao