| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-49434: PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() |
| |
| The sysfs sriov_numvfs_store() path acquires the device lock before the |
| config space access lock: |
| |
| sriov_numvfs_store |
| device_lock # A (1) acquire device lock |
| sriov_configure |
| vfio_pci_sriov_configure # (for example) |
| vfio_pci_core_sriov_configure |
| pci_disable_sriov |
| sriov_disable |
| pci_cfg_access_lock |
| pci_wait_cfg # B (4) wait for dev->block_cfg_access == 0 |
| |
| Previously, pci_dev_lock() acquired the config space access lock before the |
| device lock: |
| |
| pci_dev_lock |
| pci_cfg_access_lock |
| dev->block_cfg_access = 1 # B (2) set dev->block_cfg_access = 1 |
| device_lock # A (3) wait for device lock |
| |
| Any path that uses pci_dev_lock(), e.g., pci_reset_function(), may |
| deadlock with sriov_numvfs_store() if the operations occur in the sequence |
| (1) (2) (3) (4). |
| |
| Avoid the deadlock by reversing the order in pci_dev_lock() so it acquires |
| the device lock before the config space access lock, the same as the |
| sriov_numvfs_store() path. |
| |
| [bhelgaas: combined and adapted commit log from Jay Zhou's independent |
| subsequent posting: |
| https://lore.kernel.org/r/20220404062539.1710-1-jianjay.zhou@huawei.com] |
| |
| The Linux kernel CVE team has assigned CVE-2022-49434 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Fixed in 4.9.318 with commit da9792920ab525b8a932aa9aeee34529ad7b83f7 |
| Fixed in 4.14.283 with commit c3c6dc1853b8bf3c718f96fd8480a6eb09ba4831 |
| Fixed in 4.19.247 with commit aed6d4d519210c28817948f34c53b6e058e0456c |
| Fixed in 5.4.198 with commit c9a81f9ed6ae3554621d6a50220b1bc74b67d81e |
| Fixed in 5.10.121 with commit eff3587b9c01439b738298475e555c028ac9f55e |
| Fixed in 5.15.46 with commit 2cdd5284035322795b0964f899eefba254cfe483 |
| Fixed in 5.17.14 with commit ea047f51172aa68841adef7f52d375002438b8f0 |
| Fixed in 5.18.3 with commit 59ea6b3ae51df7cd6bfd84c9c0030609b9315622 |
| Fixed in 5.19 with commit a91ee0e9fca9d7501286cfbced9b30a33e52740a |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-49434 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/pci/pci.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/da9792920ab525b8a932aa9aeee34529ad7b83f7 |
| https://git.kernel.org/stable/c/c3c6dc1853b8bf3c718f96fd8480a6eb09ba4831 |
| https://git.kernel.org/stable/c/aed6d4d519210c28817948f34c53b6e058e0456c |
| https://git.kernel.org/stable/c/c9a81f9ed6ae3554621d6a50220b1bc74b67d81e |
| https://git.kernel.org/stable/c/eff3587b9c01439b738298475e555c028ac9f55e |
| https://git.kernel.org/stable/c/2cdd5284035322795b0964f899eefba254cfe483 |
| https://git.kernel.org/stable/c/ea047f51172aa68841adef7f52d375002438b8f0 |
| https://git.kernel.org/stable/c/59ea6b3ae51df7cd6bfd84c9c0030609b9315622 |
| https://git.kernel.org/stable/c/a91ee0e9fca9d7501286cfbced9b30a33e52740a |
