Bugzilla – Bug 1222048
VUL-0: REJECTED: CVE-2024-26650: kernel: platform/x86: deadlock when rescan is triggered by /sys/bus/pci/rescan
Last modified: 2024-07-08 14:32:32 UTC
In the Linux kernel, the following vulnerability has been resolved: platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe p2sb_bar() unhides P2SB device to get resources from the device. It guards the operation by locking pci_rescan_remove_lock so that parallel rescans do not find the P2SB device. However, this lock causes deadlock when PCI bus rescan is triggered by /sys/bus/pci/rescan. The rescan locks pci_rescan_remove_lock and probes PCI devices. When PCI devices call p2sb_bar() during probe, it locks pci_rescan_remove_lock again. Hence the deadlock. To avoid the deadlock, do not lock pci_rescan_remove_lock in p2sb_bar(). Instead, do the lock at fs_initcall. Introduce p2sb_cache_resources() for fs_initcall which gets and caches the P2SB resources. At p2sb_bar(), refer the cache and return to the caller. Before operating the device at P2SB DEVFN for resource cache, check that its device class is PCI_CLASS_MEMORY_OTHER 0x0580 that PCH specifications define. This avoids unexpected operation to other devices at the same DEVFN. Tested-by Klara Modin <klarasmodin@gmail.com> References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-26650 https://www.cve.org/CVERecord?id=CVE-2024-26650 https://git.kernel.org/stable/c/2841631a03652f32b595c563695d0461072e0de4 https://git.kernel.org/stable/c/5913320eb0b3ec88158cfcb0fa5e996bf4ef681b https://git.kernel.org/stable/c/847e1eb30e269a094da046c08273abe3f3361cf2 https://git.kernel.org/stable/c/d281ac9a987c553d93211b90fd4fe97d8eca32cd
Already fixed in SLE15-SP6-GA and newer. Older branches are not affected.
(In reply to Carlos López from comment #1) > Already fixed in SLE15-SP6-GA and newer. Older branches are not affected. This was fixed by 5913320eb0b3 ("platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe") in 6.8 and from a quick look, I don't see it backported in SLE15-SP6-GA. This seems to be maintained by Takashi. Takashi, can you please take look to confirm? Feel free to reassign if there is a better person to handle it.
(In reply to Gabriel Krisman Bertazi from comment #2) > (In reply to Carlos López from comment #1) > > Already fixed in SLE15-SP6-GA and newer. Older branches are not affected. > > This was fixed by 5913320eb0b3 ("platform/x86: p2sb: Allow p2sb_bar() calls > during PCI device probe") in 6.8 and from a quick look, I don't see it > backported in SLE15-SP6-GA. It's in SLE15-SP6 branch. As it's CVSS 4.4, we don't need for GA. > This seems to be maintained by Takashi. Takashi, can you please take look to > confirm? Feel free to reassign if there is a better person to handle it. I updated the patch reference on SLE15-SP6 branch. Reassigned back to security team.
CVE got rejected: https://lore.kernel.org/linux-cve-announce/2024052354-REJECTED-9dd7@gregkh/T/