Revision 647e82dbf85124697be59a4b4cf00c0d38177dcb authored by Andy Shevchenko on 01 September 2022, 11:34:06 UTC, committed by Hans de Goede on 01 September 2022, 15:51:34 UTC
We have to copy only selected fields from the original resource. Because a PCI device will be removed immediately after getting its resources, we may not use any allocated data, hence we may not copy any pointers. Consider the following scenario: 1/ a caller of p2sb_bar() gets the resource; 2/ the resource has been copied by platform_device_add_data() in order to create a platform device; 3/ the platform device creation will call for the device driver's ->probe() as soon as a match found; 4/ the ->probe() takes given resources (see 2/) and tries to access one of its field, i.e. 'name', in the __devm_ioremap_resource() to create a pretty looking output; 5/ but the 'name' is a dangling pointer because p2sb_bar() removed a PCI device, which 'name' had been copied to the caller's memory. 6/ UAF (Use-After-Free) as a result. Kudos to Mika for the initial analisys of the issue. Fixes: 9745fb07474f ("platform/x86/intel: Add Primary to Sideband (P2SB) bridge support") Reported-by: kernel test robot <oliver.sang@intel.com> Suggested-by: Mika Westerberg <mika.westerberg@linux.intel.com> Link: https://lore.kernel.org/linux-i2c/YvPCbnKqDiL2XEKp@xsang-OptiPlex-9020/ Link: https://lore.kernel.org/linux-i2c/YtjAswDKfiuDfWYs@xsang-OptiPlex-9020/ Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20220901113406.65876-1-andriy.shevchenko@linux.intel.com Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
1 parent 5542dfc
File | Mode | Size |
---|---|---|
Kconfig | -rw-r--r-- | 16.2 KB |
Makefile | -rw-r--r-- | 2.9 KB |
al_mc_edac.c | -rw-r--r-- | 9.4 KB |
altera_edac.c | -rw-r--r-- | 60.7 KB |
altera_edac.h | -rw-r--r-- | 12.9 KB |
amd64_edac.c | -rw-r--r-- | 111.6 KB |
amd64_edac.h | -rw-r--r-- | 15.3 KB |
amd76x_edac.c | -rw-r--r-- | 9.3 KB |
amd8111_edac.c | -rw-r--r-- | 15.9 KB |
amd8111_edac.h | -rw-r--r-- | 3.6 KB |
amd8131_edac.c | -rw-r--r-- | 9.9 KB |
amd8131_edac.h | -rw-r--r-- | 3.1 KB |
armada_xp_edac.c | -rw-r--r-- | 18.0 KB |
aspeed_edac.c | -rw-r--r-- | 9.9 KB |
bluefield_edac.c | -rw-r--r-- | 9.1 KB |
cell_edac.c | -rw-r--r-- | 7.7 KB |
cpc925_edac.c | -rw-r--r-- | 30.6 KB |
debugfs.c | -rw-r--r-- | 3.9 KB |
dmc520_edac.c | -rw-r--r-- | 16.4 KB |
e752x_edac.c | -rw-r--r-- | 40.7 KB |
e7xxx_edac.c | -rw-r--r-- | 16.1 KB |
edac_device.c | -rw-r--r-- | 16.3 KB |
edac_device.h | -rw-r--r-- | 10.5 KB |
edac_device_sysfs.c | -rw-r--r-- | 23.2 KB |
edac_mc.c | -rw-r--r-- | 26.1 KB |
edac_mc.h | -rw-r--r-- | 7.7 KB |
edac_mc_sysfs.c | -rw-r--r-- | 25.8 KB |
edac_module.c | -rw-r--r-- | 3.3 KB |
edac_module.h | -rw-r--r-- | 4.6 KB |
edac_pci.c | -rw-r--r-- | 7.3 KB |
edac_pci.h | -rw-r--r-- | 6.8 KB |
edac_pci_sysfs.c | -rw-r--r-- | 18.9 KB |
fsl_ddr_edac.c | -rw-r--r-- | 15.4 KB |
fsl_ddr_edac.h | -rw-r--r-- | 2.2 KB |
ghes_edac.c | -rw-r--r-- | 12.5 KB |
highbank_l2_edac.c | -rw-r--r-- | 3.4 KB |
highbank_mc_edac.c | -rw-r--r-- | 6.9 KB |
i10nm_base.c | -rw-r--r-- | 17.6 KB |
i3000_edac.c | -rw-r--r-- | 13.7 KB |
i3200_edac.c | -rw-r--r-- | 12.7 KB |
i5000_edac.c | -rw-r--r-- | 42.1 KB |
i5100_edac.c | -rw-r--r-- | 29.9 KB |
i5400_edac.c | -rw-r--r-- | 39.8 KB |
i7300_edac.c | -rw-r--r-- | 35.1 KB |
i7core_edac.c | -rw-r--r-- | 61.5 KB |
i82443bxgx_edac.c | -rw-r--r-- | 13.6 KB |
i82860_edac.c | -rw-r--r-- | 9.1 KB |
i82875p_edac.c | -rw-r--r-- | 14.6 KB |
i82975x_edac.c | -rw-r--r-- | 18.1 KB |
ie31200_edac.c | -rw-r--r-- | 19.2 KB |
igen6_edac.c | -rw-r--r-- | 31.1 KB |
layerscape_edac.c | -rw-r--r-- | 1.6 KB |
mce_amd.c | -rw-r--r-- | 36.2 KB |
mce_amd.h | -rw-r--r-- | 1.6 KB |
mpc85xx_edac.c | -rw-r--r-- | 19.4 KB |
mpc85xx_edac.h | -rw-r--r-- | 2.8 KB |
octeon_edac-l2c.c | -rw-r--r-- | 5.3 KB |
octeon_edac-lmc.c | -rw-r--r-- | 8.5 KB |
octeon_edac-pc.c | -rw-r--r-- | 3.5 KB |
octeon_edac-pci.c | -rw-r--r-- | 2.7 KB |
pasemi_edac.c | -rw-r--r-- | 8.0 KB |
pnd2_edac.c | -rw-r--r-- | 42.2 KB |
pnd2_edac.h | -rw-r--r-- | 5.6 KB |
ppc4xx_edac.c | -rw-r--r-- | 39.2 KB |
ppc4xx_edac.h | -rw-r--r-- | 7.0 KB |
qcom_edac.c | -rw-r--r-- | 10.9 KB |
r82600_edac.c | -rw-r--r-- | 11.7 KB |
sb_edac.c | -rw-r--r-- | 93.9 KB |
sifive_edac.c | -rw-r--r-- | 2.5 KB |
skx_base.c | -rw-r--r-- | 19.4 KB |
skx_common.c | -rw-r--r-- | 17.8 KB |
skx_common.h | -rw-r--r-- | 5.0 KB |
synopsys_edac.c | -rw-r--r-- | 38.1 KB |
thunderx_edac.c | -rw-r--r-- | 52.8 KB |
ti_edac.c | -rw-r--r-- | 8.4 KB |
wq.c | -rw-r--r-- | 823 bytes |
x38_edac.c | -rw-r--r-- | 11.9 KB |
xgene_edac.c | -rw-r--r-- | 59.0 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...