131412f4f6
commit 281e878eab191cce4259abbbf1a0322e3adae02c upstream. When pciehp is unbound (e.g. on unplug of a Thunderbolt device), the hotplug_slot struct is deregistered and thus freed before freeing the IRQ. The IRQ handler and the work items it schedules print the slot name referenced from the freed structure in various informational and debug log messages, each time resulting in a quadruple dereference of freed pointers (hotplug_slot -> pci_slot -> kobject -> name). At best the slot name is logged as "(null)", at worst kernel memory is exposed in logs or the driver crashes: pciehp 0000:10:00.0:pcie204: Slot((null)): Card not present An attacker may provoke the bug by unplugging multiple devices on a Thunderbolt daisy chain at once. Unplugging can also be simulated by powering down slots via sysfs. The bug is particularly easy to trigger in poll mode. It has been present since the driver's introduction in 2004: https://git.kernel.org/tglx/history/c/c16b4b14d980 Fix by rearranging teardown such that the IRQ is freed first. Run the work items queued by the IRQ handler to completion before freeing the hotplug_slot struct by draining the work queue from the ->release_slot callback which is invoked by pci_hp_deregister(). Signed-off-by: Lukas Wunner <lukas@wunner.de> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Cc: stable@vger.kernel.org # v2.6.4 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| acpi_pcihp.c | ||
| acpiphp.h | ||
| acpiphp_core.c | ||
| acpiphp_glue.c | ||
| acpiphp_ibm.c | ||
| cpci_hotplug.h | ||
| cpci_hotplug_core.c | ||
| cpci_hotplug_pci.c | ||
| cpcihp_generic.c | ||
| cpcihp_zt5550.c | ||
| cpcihp_zt5550.h | ||
| cpqphp.h | ||
| cpqphp_core.c | ||
| cpqphp_ctrl.c | ||
| cpqphp_nvram.c | ||
| cpqphp_nvram.h | ||
| cpqphp_pci.c | ||
| cpqphp_sysfs.c | ||
| ibmphp.h | ||
| ibmphp_core.c | ||
| ibmphp_ebda.c | ||
| ibmphp_hpc.c | ||
| ibmphp_pci.c | ||
| ibmphp_res.c | ||
| Kconfig | ||
| Makefile | ||
| pci_hotplug_core.c | ||
| pciehp.h | ||
| pciehp_core.c | ||
| pciehp_ctrl.c | ||
| pciehp_hpc.c | ||
| pciehp_pci.c | ||
| pcihp_skeleton.c | ||
| rpadlpar.h | ||
| rpadlpar_core.c | ||
| rpadlpar_sysfs.c | ||
| rpaphp.h | ||
| rpaphp_core.c | ||
| rpaphp_pci.c | ||
| rpaphp_slot.c | ||
| s390_pci_hpc.c | ||
| sgi_hotplug.c | ||
| shpchp.h | ||
| shpchp_core.c | ||
| shpchp_ctrl.c | ||
| shpchp_hpc.c | ||
| shpchp_pci.c | ||
| shpchp_sysfs.c | ||