Revision 647e82dbf85124697be59a4b4cf00c0d38177dcb authored by Andy Shevchenko on 01 September 2022, 11:34:06 UTC, committed by Hans de Goede on 01 September 2022, 15:51:34 UTC
We have to copy only selected fields from the original resource.
Because a PCI device will be removed immediately after getting
its resources, we may not use any allocated data, hence we may
not copy any pointers.

Consider the following scenario:

  1/ a caller of p2sb_bar() gets the resource;

  2/ the resource has been copied by platform_device_add_data()
     in order to create a platform device;

  3/ the platform device creation will call for the device driver's
     ->probe() as soon as a match found;

  4/ the ->probe() takes given resources (see 2/) and tries to
     access one of its field, i.e. 'name', in the
     __devm_ioremap_resource() to create a pretty looking output;

  5/ but the 'name' is a dangling pointer because p2sb_bar()
     removed a PCI device, which 'name' had been copied to
     the caller's memory.

  6/ UAF (Use-After-Free) as a result.

Kudos to Mika for the initial analisys of the issue.

Fixes: 9745fb07474f ("platform/x86/intel: Add Primary to Sideband (P2SB) bridge support")
Reported-by: kernel test robot <oliver.sang@intel.com>
Suggested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Link: https://lore.kernel.org/linux-i2c/YvPCbnKqDiL2XEKp@xsang-OptiPlex-9020/
Link: https://lore.kernel.org/linux-i2c/YtjAswDKfiuDfWYs@xsang-OptiPlex-9020/
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20220901113406.65876-1-andriy.shevchenko@linux.intel.com
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
1 parent 5542dfc
History
File Mode Size
cxgbit
Kconfig -rw-r--r-- 338 bytes
Makefile -rw-r--r-- 648 bytes
iscsi_target.c -rw-r--r-- 130.0 KB
iscsi_target.h -rw-r--r-- 2.5 KB
iscsi_target_auth.c -rw-r--r-- 13.9 KB
iscsi_target_auth.h -rw-r--r-- 1.3 KB
iscsi_target_configfs.c -rw-r--r-- 45.0 KB
iscsi_target_datain_values.c -rw-r--r-- 13.8 KB
iscsi_target_datain_values.h -rw-r--r-- 683 bytes
iscsi_target_device.c -rw-r--r-- 1.7 KB
iscsi_target_device.h -rw-r--r-- 328 bytes
iscsi_target_erl0.c -rw-r--r-- 26.0 KB
iscsi_target_erl0.h -rw-r--r-- 951 bytes
iscsi_target_erl1.c -rw-r--r-- 31.4 KB
iscsi_target_erl1.h -rw-r--r-- 1.7 KB
iscsi_target_erl2.c -rw-r--r-- 11.7 KB
iscsi_target_erl2.h -rw-r--r-- 1.1 KB
iscsi_target_login.c -rw-r--r-- 39.3 KB
iscsi_target_login.h -rw-r--r-- 1.2 KB
iscsi_target_nego.c -rw-r--r-- 36.6 KB
iscsi_target_nego.h -rw-r--r-- 909 bytes
iscsi_target_nodeattrib.c -rw-r--r-- 7.1 KB
iscsi_target_nodeattrib.h -rw-r--r-- 913 bytes
iscsi_target_parameters.c -rw-r--r-- 45.9 KB
iscsi_target_parameters.h -rw-r--r-- 9.8 KB
iscsi_target_seq_pdu_list.c -rw-r--r-- 16.9 KB
iscsi_target_seq_pdu_list.h -rw-r--r-- 2.2 KB
iscsi_target_stat.c -rw-r--r-- 22.7 KB
iscsi_target_tmr.c -rw-r--r-- 23.1 KB
iscsi_target_tmr.h -rw-r--r-- 747 bytes
iscsi_target_tpg.c -rw-r--r-- 22.3 KB
iscsi_target_tpg.h -rw-r--r-- 2.8 KB
iscsi_target_transport.c -rw-r--r-- 1.2 KB
iscsi_target_util.c -rw-r--r-- 34.1 KB
iscsi_target_util.h -rw-r--r-- 4.2 KB

back to top