Bug 1222048 (CVE-2024-26650)

Summary:	VUL-0: REJECTED: CVE-2024-26650: kernel: platform/x86: deadlock when rescan is triggered by /sys/bus/pci/rescan
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED INVALID	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	andrea.mattiazzo, carlos.lopez, gabriel.bertazi
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/399016/
Whiteboard:	CVSSv3.1:SUSE:CVE-2024-26650:4.4:(AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-03-27 10:27:59 UTC

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe

p2sb_bar() unhides P2SB device to get resources from the device. It
guards the operation by locking pci_rescan_remove_lock so that parallel
rescans do not find the P2SB device. However, this lock causes deadlock
when PCI bus rescan is triggered by /sys/bus/pci/rescan. The rescan
locks pci_rescan_remove_lock and probes PCI devices. When PCI devices
call p2sb_bar() during probe, it locks pci_rescan_remove_lock again.
Hence the deadlock.

To avoid the deadlock, do not lock pci_rescan_remove_lock in p2sb_bar().
Instead, do the lock at fs_initcall. Introduce p2sb_cache_resources()
for fs_initcall which gets and caches the P2SB resources. At p2sb_bar(),
refer the cache and return to the caller.

Before operating the device at P2SB DEVFN for resource cache, check
that its device class is PCI_CLASS_MEMORY_OTHER 0x0580 that PCH
specifications define. This avoids unexpected operation to other devices
at the same DEVFN.

Tested-by Klara Modin <klarasmodin@gmail.com>

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-26650
https://www.cve.org/CVERecord?id=CVE-2024-26650
https://git.kernel.org/stable/c/2841631a03652f32b595c563695d0461072e0de4
https://git.kernel.org/stable/c/5913320eb0b3ec88158cfcb0fa5e996bf4ef681b
https://git.kernel.org/stable/c/847e1eb30e269a094da046c08273abe3f3361cf2
https://git.kernel.org/stable/c/d281ac9a987c553d93211b90fd4fe97d8eca32cd

Comment 1 Carlos López 2024-03-27 10:28:59 UTC

Already fixed in SLE15-SP6-GA and newer. Older branches are not affected.

Comment 2 Gabriel Krisman Bertazi 2024-04-26 23:49:51 UTC

(In reply to Carlos López from comment #1)
> Already fixed in SLE15-SP6-GA and newer. Older branches are not affected.

This was fixed by 5913320eb0b3 ("platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe") in 6.8 and from a quick look, I don't see it backported in SLE15-SP6-GA.  

This seems to be maintained by Takashi. Takashi, can you please take look to confirm?  Feel free to reassign if there is a better person to handle it.

Comment 3 Takashi Iwai 2024-04-27 07:41:37 UTC

(In reply to Gabriel Krisman Bertazi from comment #2)
> (In reply to Carlos López from comment #1)
> > Already fixed in SLE15-SP6-GA and newer. Older branches are not affected.
> 
> This was fixed by 5913320eb0b3 ("platform/x86: p2sb: Allow p2sb_bar() calls
> during PCI device probe") in 6.8 and from a quick look, I don't see it
> backported in SLE15-SP6-GA.  

It's in SLE15-SP6 branch.  As it's CVSS 4.4, we don't need for GA.

> This seems to be maintained by Takashi. Takashi, can you please take look to
> confirm?  Feel free to reassign if there is a better person to handle it.

I updated the patch reference on SLE15-SP6 branch.

Reassigned back to security team.

Comment 5 Andrea Mattiazzo 2024-05-24 14:58:18 UTC

CVE got rejected: https://lore.kernel.org/linux-cve-announce/2024052354-REJECTED-9dd7@gregkh/T/