Received-SPF: pass (google.com: domain of linux-kernel+bounces-163140-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Date: Mon, 29 Apr 2024 23:32:53 +0000
From: Mostafa Saleh <smostafa@google.com>
To: Thomas Gleixner <tglx@linutronix.de>
Cc: bhelgaas@google.com, linux-pci@vger.kernel.org,
	linux-kernel@vger.kernel.org, ilpo.jarvinen@linux.intel.com,
	kernel-team@android.com
Subject: Re: [PATCH] PCI/MSI: Fix UAF in msi_capability_init
Message-ID: <ZjAuJV87RjOu7gSy@google.com>
References: <20240429034112.140594-1-smostafa@google.com>
 <87zftbswwo.ffs@tglx>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <87zftbswwo.ffs@tglx>

Hi Thomas,

On Mon, Apr 29, 2024 at 11:04:39PM +0200, Thomas Gleixner wrote:
> On Mon, Apr 29 2024 at 03:41, Mostafa Saleh wrote:
> >  err:
> > -	pci_msi_unmask(entry, msi_multi_mask(entry));
> > +	/* Re-read the descriptor as it might have been freed */
> > +	entry = msi_first_desc(&dev->dev, MSI_DESC_ALL);
> > +	if (entry)
> > +		pci_msi_unmask(entry, msi_multi_mask(entry));
> 
> What unmasks the entry in the NULL case?

Apparently nothing, I missed that. (PCI isn’t really my area, I
prefer dealing with non standardised platform devices :))

> 
> The mask has to be undone. So you need something like the uncompiled
> below.
> 
> Thanks,
> 
>         tglx
> ---
> 
> --- a/drivers/pci/msi/msi.c
> +++ b/drivers/pci/msi/msi.c
> @@ -349,7 +349,7 @@ static int msi_capability_init(struct pc
>  			       struct irq_affinity *affd)
>  {
>  	struct irq_affinity_desc *masks = NULL;
> -	struct msi_desc *entry;
> +	struct msi_desc *entry, desc;
>  	int ret;
>  
>  	/* Reject multi-MSI early on irq domain enabled architectures */
> @@ -374,6 +374,12 @@ static int msi_capability_init(struct pc
>  	/* All MSIs are unmasked by default; mask them all */
>  	entry = msi_first_desc(&dev->dev, MSI_DESC_ALL);
>  	pci_msi_mask(entry, msi_multi_mask(entry));
> +	/*
> +	 * Copy the MSI descriptor for the error path because
> +	 * pci_msi_setup_msi_irqs() will free it for the hierarchical
> +	 * interrupt domain case.
> +	 */
> +	memcpy(&desc, entry, sizeof(desc));
>  
>  	/* Configure MSI capability structure */
>  	ret = pci_msi_setup_msi_irqs(dev, nvec, PCI_CAP_ID_MSI);
> @@ -393,7 +399,7 @@ static int msi_capability_init(struct pc
>  	goto unlock;
>  
>  err:
> -	pci_msi_unmask(entry, msi_multi_mask(entry));
> +	pci_msi_unmask(&desc, msi_multi_mask(&desc));
>  	pci_free_msi_irqs(dev);
>  fail:
>  	dev->msi_enabled = 0;

I tested it with my stub, but since I didn't write the code, here
is my tag, let me know if you want me to respin.

Tested-by: Mostafa Saleh <smostafa@google.com>

Thanks,
Mostafa