| Message ID | 20230926025936.7115-1-dinghao.liu@zju.edu.cn (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | PCI: xgene-msi: Fix a potential UAF in xgene_msi_probe | expand |
On Tue, 26 Sep 2023 03:59:36 +0100, Dinghao Liu <dinghao.liu@zju.edu.cn> wrote: > > xgene_allocate_domains() will call irq_domain_remove() to free > msi->inner_domain on failure. However, its caller, xgene_msi_probe(), > will also call irq_domain_remove() through xgene_msi_remove() on the > same failure, which may lead to a use-after-free. Remove the first > irq_domain_remove() and let xgene_free_domains() cleanup domains. > > Fixes: dcd19de36775 ("PCI: xgene: Add APM X-Gene v1 PCIe MSI/MSIX termination driver") > Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> > --- > > Changelog: > > v2: -Remove irq_domain_remove() instead of nulling msi_domain. Unfortunately, your email doesn't indicate this is v2. M.
> On Tue, 26 Sep 2023 03:59:36 +0100, > Dinghao Liu <dinghao.liu@zju.edu.cn> wrote: > > > > xgene_allocate_domains() will call irq_domain_remove() to free > > msi->inner_domain on failure. However, its caller, xgene_msi_probe(), > > will also call irq_domain_remove() through xgene_msi_remove() on the > > same failure, which may lead to a use-after-free. Remove the first > > irq_domain_remove() and let xgene_free_domains() cleanup domains. > > > > Fixes: dcd19de36775 ("PCI: xgene: Add APM X-Gene v1 PCIe MSI/MSIX termination driver") > > Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> > > --- > > > > Changelog: > > > > v2: -Remove irq_domain_remove() instead of nulling msi_domain. > > Unfortunately, your email doesn't indicate this is v2. Sorry, my mistake. I will resend a new patch soon. Regards, Dinghao
diff --git a/drivers/pci/controller/pci-xgene-msi.c b/drivers/pci/controller/pci-xgene-msi.c index 3ce38dfd0d29..0f9b9394399d 100644 --- a/drivers/pci/controller/pci-xgene-msi.c +++ b/drivers/pci/controller/pci-xgene-msi.c @@ -251,10 +251,8 @@ static int xgene_allocate_domains(struct xgene_msi *msi) &xgene_msi_domain_info, msi->inner_domain); - if (!msi->msi_domain) { - irq_domain_remove(msi->inner_domain); + if (!msi->msi_domain) return -ENOMEM; - } return 0; }
xgene_allocate_domains() will call irq_domain_remove() to free msi->inner_domain on failure. However, its caller, xgene_msi_probe(), will also call irq_domain_remove() through xgene_msi_remove() on the same failure, which may lead to a use-after-free. Remove the first irq_domain_remove() and let xgene_free_domains() cleanup domains. Fixes: dcd19de36775 ("PCI: xgene: Add APM X-Gene v1 PCIe MSI/MSIX termination driver") Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> --- Changelog: v2: -Remove irq_domain_remove() instead of nulling msi_domain. --- drivers/pci/controller/pci-xgene-msi.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)