Revision 647e82dbf85124697be59a4b4cf00c0d38177dcb authored by Andy Shevchenko on 01 September 2022, 11:34:06 UTC, committed by Hans de Goede on 01 September 2022, 15:51:34 UTC
We have to copy only selected fields from the original resource.
Because a PCI device will be removed immediately after getting
its resources, we may not use any allocated data, hence we may
not copy any pointers.

Consider the following scenario:

  1/ a caller of p2sb_bar() gets the resource;

  2/ the resource has been copied by platform_device_add_data()
     in order to create a platform device;

  3/ the platform device creation will call for the device driver's
     ->probe() as soon as a match found;

  4/ the ->probe() takes given resources (see 2/) and tries to
     access one of its field, i.e. 'name', in the
     __devm_ioremap_resource() to create a pretty looking output;

  5/ but the 'name' is a dangling pointer because p2sb_bar()
     removed a PCI device, which 'name' had been copied to
     the caller's memory.

  6/ UAF (Use-After-Free) as a result.

Kudos to Mika for the initial analisys of the issue.

Fixes: 9745fb07474f ("platform/x86/intel: Add Primary to Sideband (P2SB) bridge support")
Reported-by: kernel test robot <oliver.sang@intel.com>
Suggested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Link: https://lore.kernel.org/linux-i2c/YvPCbnKqDiL2XEKp@xsang-OptiPlex-9020/
Link: https://lore.kernel.org/linux-i2c/YtjAswDKfiuDfWYs@xsang-OptiPlex-9020/
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20220901113406.65876-1-andriy.shevchenko@linux.intel.com
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
1 parent 5542dfc
History
File Mode Size
Kconfig -rw-r--r-- 16.2 KB
Makefile -rw-r--r-- 2.9 KB
al_mc_edac.c -rw-r--r-- 9.4 KB
altera_edac.c -rw-r--r-- 60.7 KB
altera_edac.h -rw-r--r-- 12.9 KB
amd64_edac.c -rw-r--r-- 111.6 KB
amd64_edac.h -rw-r--r-- 15.3 KB
amd76x_edac.c -rw-r--r-- 9.3 KB
amd8111_edac.c -rw-r--r-- 15.9 KB
amd8111_edac.h -rw-r--r-- 3.6 KB
amd8131_edac.c -rw-r--r-- 9.9 KB
amd8131_edac.h -rw-r--r-- 3.1 KB
armada_xp_edac.c -rw-r--r-- 18.0 KB
aspeed_edac.c -rw-r--r-- 9.9 KB
bluefield_edac.c -rw-r--r-- 9.1 KB
cell_edac.c -rw-r--r-- 7.7 KB
cpc925_edac.c -rw-r--r-- 30.6 KB
debugfs.c -rw-r--r-- 3.9 KB
dmc520_edac.c -rw-r--r-- 16.4 KB
e752x_edac.c -rw-r--r-- 40.7 KB
e7xxx_edac.c -rw-r--r-- 16.1 KB
edac_device.c -rw-r--r-- 16.3 KB
edac_device.h -rw-r--r-- 10.5 KB
edac_device_sysfs.c -rw-r--r-- 23.2 KB
edac_mc.c -rw-r--r-- 26.1 KB
edac_mc.h -rw-r--r-- 7.7 KB
edac_mc_sysfs.c -rw-r--r-- 25.8 KB
edac_module.c -rw-r--r-- 3.3 KB
edac_module.h -rw-r--r-- 4.6 KB
edac_pci.c -rw-r--r-- 7.3 KB
edac_pci.h -rw-r--r-- 6.8 KB
edac_pci_sysfs.c -rw-r--r-- 18.9 KB
fsl_ddr_edac.c -rw-r--r-- 15.4 KB
fsl_ddr_edac.h -rw-r--r-- 2.2 KB
ghes_edac.c -rw-r--r-- 12.5 KB
highbank_l2_edac.c -rw-r--r-- 3.4 KB
highbank_mc_edac.c -rw-r--r-- 6.9 KB
i10nm_base.c -rw-r--r-- 17.6 KB
i3000_edac.c -rw-r--r-- 13.7 KB
i3200_edac.c -rw-r--r-- 12.7 KB
i5000_edac.c -rw-r--r-- 42.1 KB
i5100_edac.c -rw-r--r-- 29.9 KB
i5400_edac.c -rw-r--r-- 39.8 KB
i7300_edac.c -rw-r--r-- 35.1 KB
i7core_edac.c -rw-r--r-- 61.5 KB
i82443bxgx_edac.c -rw-r--r-- 13.6 KB
i82860_edac.c -rw-r--r-- 9.1 KB
i82875p_edac.c -rw-r--r-- 14.6 KB
i82975x_edac.c -rw-r--r-- 18.1 KB
ie31200_edac.c -rw-r--r-- 19.2 KB
igen6_edac.c -rw-r--r-- 31.1 KB
layerscape_edac.c -rw-r--r-- 1.6 KB
mce_amd.c -rw-r--r-- 36.2 KB
mce_amd.h -rw-r--r-- 1.6 KB
mpc85xx_edac.c -rw-r--r-- 19.4 KB
mpc85xx_edac.h -rw-r--r-- 2.8 KB
octeon_edac-l2c.c -rw-r--r-- 5.3 KB
octeon_edac-lmc.c -rw-r--r-- 8.5 KB
octeon_edac-pc.c -rw-r--r-- 3.5 KB
octeon_edac-pci.c -rw-r--r-- 2.7 KB
pasemi_edac.c -rw-r--r-- 8.0 KB
pnd2_edac.c -rw-r--r-- 42.2 KB
pnd2_edac.h -rw-r--r-- 5.6 KB
ppc4xx_edac.c -rw-r--r-- 39.2 KB
ppc4xx_edac.h -rw-r--r-- 7.0 KB
qcom_edac.c -rw-r--r-- 10.9 KB
r82600_edac.c -rw-r--r-- 11.7 KB
sb_edac.c -rw-r--r-- 93.9 KB
sifive_edac.c -rw-r--r-- 2.5 KB
skx_base.c -rw-r--r-- 19.4 KB
skx_common.c -rw-r--r-- 17.8 KB
skx_common.h -rw-r--r-- 5.0 KB
synopsys_edac.c -rw-r--r-- 38.1 KB
thunderx_edac.c -rw-r--r-- 52.8 KB
ti_edac.c -rw-r--r-- 8.4 KB
wq.c -rw-r--r-- 823 bytes
x38_edac.c -rw-r--r-- 11.9 KB
xgene_edac.c -rw-r--r-- 59.0 KB

back to top