Received-SPF: pass (google.com: domain of linux-kernel+bounces-188605-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Date: Fri, 24 May 2024 12:33:22 +0200
From: Michal Hocko <mhocko@suse.com>
To: cve@kernel.org, linux-kernel@vger.kernel.org
Cc: linux-cve-announce@vger.kernel.org, Lee Jones <lee@kernel.org>
Subject: Re: CVE-2024-26650: platform/x86: p2sb: Allow p2sb_bar() calls
 during PCI device probe
Message-ID: <ZlBs8u8M5US5aAro@tiehlicka>
References: <20240326175007.1388794-18-lee@kernel.org>
 <Zkz2qpUP-HVROO1I@tiehlicka>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Zkz2qpUP-HVROO1I@tiehlicka>

On Tue 21-05-24 21:31:54, Michal Hocko wrote:
> This patch has been reverted in upstream by 03c6284df179 ("Revert
> "drm/amd/amdgpu: Fix potential ioremap() memory leaks in
> amdgpu_device_init()"") and based on the changelog the CVE should be
> rejected.

Wait a second. I've screwed up here. I am sorry, my bad. This revert has
nothing to do with CVE-2024-26650 - 5913320eb0b3 ("platform/x86: p2sb:
Allow p2sb_bar() calls during PCI device probe"). I guess I got
completely confused by the fact that the same change exists under a
different commit b28ff7a7c324 ("platform/x86: p2sb: Allow p2sb_bar()
calls during PCI device probe").

I must have mixed this with CVE-2024-35928 somehow. zhengzucheng has
already pointed to that one. Sorry about that!

-- 
Michal Hocko
SUSE Labs