Received: by 2002:a05:6358:a55:b0:ec:fcf4:3ecf with SMTP id 21csp5092237rwb; Sun, 22 Jan 2023 03:10:34 -0800 (PST) X-Google-Smtp-Source: AMrXdXv/nW3S4ys6J1WAA0Hn+nZuh5of/Ls92FeG3VAvhS7VMwEOtQx/ZM7iS+Yqf8GnkSgWKry6 X-Received: by 2002:a17:902:d2d1:b0:194:c5d6:328 with SMTP id n17-20020a170902d2d100b00194c5d60328mr19299759plc.35.1674385834563; Sun, 22 Jan 2023 03:10:34 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1674385834; cv=none; d=google.com; s=arc-20160816; b=SfPn6tD23SaaspGwdKgfMtJ84cGRHLVsTXAp3oaiT1KAKAKI/UxJ0KRbIVxs7m4b+H MmrFNcYmEDyob4aWCTqa66pw32VrDWJj6bMOwA5k/Q6VQE5NEARl+3zJLLUkYqivfM4N 4dy1U+qeSb3HBOhsixf/dmeabaTjF/Ip2uEp72D1N99ncn5N8YbudT+/uDTPzaqVp0yS /wk37Q0dTtRCPFLBfbl6TqjM8AI936wiDlJoOELZ2Foj+ipTkwiYDl/WC2EKjDgS5pwA McF7rEAdDj8ml1dIFb4q44syjP9gRTdyOAP3pg4DjjzoaXmMefuZQufV9hXVUuzhDguJ IeoA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:mime-version:user-agent:references:in-reply-to :subject:cc:to:from:message-id:date:dkim-signature; bh=sTWVEFCyJiLdTv1WLA/iA6R8H6rf6nwDkGREe0a7pcM=; b=VGcZOIst49xBGFwVJBFXwAif6uvL0J+IrA6NzT40ie/kHGT1DiDHRIssjh5qbVxcCq YE3kVK3E62D+tpTWQGg89PoK5wES50vJtIDdyRrjCBqO3bSAQCAgIV9HthMJmmiRGec4 OXGWReRDnbj9brcZ2XMc9/1i4ZrzriKDH3mDABUj2AuT01tUgS7N64L9woLywYU3RvSo iWUUN6hJc2iF/4Z5W625o2rhKqXiEccVNb5rHQW0mJg99KTsawToASCuIu7z52sxgEzF SBf9PgSfI7n6gGecuSiB6L2+xk09QkUAHxq9mb9kBYE1CkicH35NfyHvadOkILY1aF2U lSDw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=q2oMDh9u; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id y21-20020a1709027c9500b00175449cf6f8si2154566pll.606.2023.01.22.03.10.28; Sun, 22 Jan 2023 03:10:34 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=q2oMDh9u; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229814AbjAVK5U (ORCPT + 50 others); Sun, 22 Jan 2023 05:57:20 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59152 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229675AbjAVK5T (ORCPT ); Sun, 22 Jan 2023 05:57:19 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5BD4816AC3; Sun, 22 Jan 2023 02:57:18 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EAB2E60B9C; Sun, 22 Jan 2023 10:57:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5279DC433D2; Sun, 22 Jan 2023 10:57:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1674385037; bh=3R2QIG0GAZjYI+AZGuoUxJ1oHchv1SGVDssxjaQpTsQ=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=q2oMDh9u4SqA/3uk1b/pZZKi3viRcSffJYZJG/m0ZxWVX9uqjG6q5j/yqH3z+CBuJ 6JXWvbzv9+GldbRoVuVFmhYkJmYfaKMchdGxrra3zEBw9gSE2ATmPNeLT5uNYLVs7o 0M/qMEJUdn6sVEDLQq6daAbKPjSNBtLeY+jcv6Bx5sMlarjwUfnnkIqP5Q5cA//u4k 6bdE8eqnCV6ddeL2777FLpU+d1fOLAhXr/biHra01Z0zZ5HVX9vxylY+FPd5fJXpY1 RfMTsfrjsf8a6wpZCsC0lxiTxTxGF6YU1M6Toq1coPxRTm89tXG03BTdFqzbOX44N6 zkLtxtnZ5O3OQ== Received: from sofa.misterjones.org ([185.219.108.64] helo=goblin-girl.misterjones.org) by disco-boy.misterjones.org with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1pJY2E-003kCk-Tw; Sun, 22 Jan 2023 10:57:15 +0000 Date: Sun, 22 Jan 2023 10:57:14 +0000 Message-ID: <86fsc2n8fp.wl-maz@kernel.org> From: Marc Zyngier To: Leon Romanovsky Cc: Alexander Shishkin , Bjorn Helgaas , Thomas Gleixner , linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, darwi@linutronix.de, elena.reshetova@intel.com, kirill.shutemov@linux.intel.com, Mika Westerberg , stable@vger.kernel.org Subject: Re: [PATCH 1/2] PCI/MSI: Cache the MSIX table size In-Reply-To: References: <20230119170633.40944-1-alexander.shishkin@linux.intel.com> <20230119170633.40944-2-alexander.shishkin@linux.intel.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/28.2 (aarch64-unknown-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-SA-Exim-Connect-IP: 185.219.108.64 X-SA-Exim-Rcpt-To: leon@kernel.org, alexander.shishkin@linux.intel.com, bhelgaas@google.com, tglx@linutronix.de, linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, darwi@linutronix.de, elena.reshetova@intel.com, kirill.shutemov@linux.intel.com, mika.westerberg@linux.intel.com, stable@vger.kernel.org X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sun, 22 Jan 2023 09:00:04 +0000, Leon Romanovsky wrote: > > On Thu, Jan 19, 2023 at 07:06:32PM +0200, Alexander Shishkin wrote: > > A malicious device can change its MSIX table size between the table > > ioremap() and subsequent accesses, resulting in a kernel page fault in > > pci_write_msg_msix(). > > > > To avoid this, cache the table size observed at the moment of table > > ioremap() and use the cached value. This, however, does not help drivers > > that peek at the PCIE_MSIX_FLAGS register directly. > > > > Signed-off-by: Alexander Shishkin > > Reviewed-by: Mika Westerberg > > Cc: stable@vger.kernel.org > > --- > > drivers/pci/msi/api.c | 7 ++++++- > > drivers/pci/msi/msi.c | 2 +- > > include/linux/pci.h | 1 + > > 3 files changed, 8 insertions(+), 2 deletions(-) > > I'm not security expert here, but not sure that this protects from anything. > 1. Kernel relies on working and not-malicious HW. There are gazillion ways > to cause crashes other than changing MSI-X. > 2. Device can report large table size, kernel will cache it and > malicious device will reduce it back. It is not handled and will cause > to kernel crash too. > Indeed, this was my exact reaction reading this patch. This only makes sure the same (potentially wrong) value is used at all times. So while this results in a consistent use, this doesn't give much guarantee. The only way to deal with this is to actually handle the resulting fault, similar to what the kernel does when accessing userspace. Not sure how possible this is with something like PCIe. M. -- Without deviation from the norm, progress is not possible.