kernel.git/drivers/pci/msi, branch linux-6.10.y

PCI/MSI: Fix UAF in msi_capability_init

2024-06-24T21:33:38Z

KFENCE reports the following UAF: BUG: KFENCE: use-after-free read in __pci_enable_msi_range+0x2c0/0x488 Use-after-free read at 0x0000000024629571 (in kfence-#12): __pci_enable_msi_range+0x2c0/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28 kfence-#12: 0x0000000008614900-0x00000000e06c228d, size=104, cache=kmalloc-128 allocated by task 81 on cpu 7 at 10.808142s: __kmem_cache_alloc_node+0x1f0/0x2bc kmalloc_trace+0x44/0x138 msi_alloc_desc+0x3c/0x9c msi_domain_insert_msi_desc+0x30/0x78 msi_setup_msi_desc+0x13c/0x184 __pci_enable_msi_range+0x258/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28 freed by task 81 on cpu 7 at 10.811436s: msi_domain_free_descs+0xd4/0x10c msi_domain_free_locked.part.0+0xc0/0x1d8 msi_domain_alloc_irqs_all_locked+0xb4/0xbc pci_msi_setup_msi_irqs+0x30/0x4c __pci_enable_msi_range+0x2a8/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28 Descriptor allocation done in: __pci_enable_msi_range msi_capability_init msi_setup_msi_desc msi_insert_msi_desc msi_domain_insert_msi_desc msi_alloc_desc ... Freed in case of failure in __msi_domain_alloc_locked() __pci_enable_msi_range msi_capability_init pci_msi_setup_msi_irqs msi_domain_alloc_irqs_all_locked msi_domain_alloc_locked __msi_domain_alloc_locked => fails msi_domain_free_locked ... That failure propagates back to pci_msi_setup_msi_irqs() in msi_capability_init() which accesses the descriptor for unmasking in the error exit path. Cure it by copying the descriptor and using the copy for the error exit path unmask operation. [ tglx: Massaged change log ] Fixes: bf6e054e0e3f ("genirq/msi: Provide msi_device_populate/destroy_sysfs()") Suggested-by: Thomas Gleixner Signed-off-by: Mostafa Saleh Signed-off-by: Thomas Gleixner Cc: Bjorn Heelgas Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20240624203729.1094506-1-smostafa@google.com

Merge branch 'pci/ims-removal'

2024-05-16T23:14:14Z

- Remove unused Interrupt Message Store (IMS) support (Bjorn Helgaas) * pci/ims-removal: Revert "genirq/msi: Provide constants for PCI/IMS support" Revert "x86/apic/msi: Enable PCI/IMS" Revert "iommu/vt-d: Enable PCI/IMS" Revert "iommu/amd: Enable PCI/IMS" Revert "PCI/MSI: Provide IMS (Interrupt Message Store) support" Revert "PCI/MSI: Provide pci_ims_alloc/free_irq()" Revert "PCI/MSI: Provide stubs for IMS functions"

Merge branch 'pci/msi'

2024-05-16T23:14:11Z

- Update coding style to "mainline is normal path, errors are the exceptions" (Andy Shevchenko) * pci/msi: PCI/MSI: Make error path handling follow the standard pattern

Revert "PCI/MSI: Provide IMS (Interrupt Message Store) support"

2024-05-15T22:01:54Z

This reverts commit 0194425af0c87acaad457989a2c6d90dba58e776. IMS (Interrupt Message Store) support appeared in v6.2, but there are no users yet. Remove it for now. We can add it back when a user comes along. If this is re-added later, the relevant part of 41efa431244f ("PCI/MSI: Provide stubs for IMS functions") should be squashed into it. Link: https://lore.kernel.org/r/20240410221307.2162676-4-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Kevin Tian Reviewed-by: Thomas Gleixner

Revert "PCI/MSI: Provide pci_ims_alloc/free_irq()"

2024-05-15T22:01:51Z

This reverts commit c9e5bea273834a63b5e9ba90ad94b305ba50704e. IMS (Interrupt Message Store) support appeared in v6.2, but there are no users yet. Remove it for now. We can add it back when a user comes along. If this is re-added later, the relevant part of 41efa431244f ("PCI/MSI: Provide stubs for IMS functions") should be squashed into it. Link: https://lore.kernel.org/r/20240410221307.2162676-3-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Kevin Tian Reviewed-by: Thomas Gleixner

PCI/MSI: Make error path handling follow the standard pattern

2024-04-26T22:04:20Z

Make error path handling follow the standard pattern, i.e. checking for errors first. This makes code much easier to read and understand despite being a bit longer. Link: https://lore.kernel.org/r/20240426144039.557907-1-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Signed-off-by: Bjorn Helgaas

PCI/MSI: Use PCI_IRQ_INTX instead of PCI_IRQ_LEGACY

2024-04-25T17:53:29Z

In pci_alloc_irq_vectors_affinity(), use the macro PCI_IRQ_INTX instead of the now deprecated PCI_IRQ_LEGACY macro. Link: https://lore.kernel.org/r/20240325070944.3600338-2-dlemoal@kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Bjorn Helgaas

PCI/MSI: Prevent MSI hardware interrupt number truncation

2024-02-19T15:11:01Z

While calculating the hardware interrupt number for a MSI interrupt, the higher bits (i.e. from bit-5 onwards a.k.a domain_nr >= 32) of the PCI domain number gets truncated because of the shifted value casting to return type of pci_domain_nr() which is 'int'. This for example is resulting in same hardware interrupt number for devices 0019:00:00.0 and 0039:00:00.0. To address this cast the PCI domain number to 'irq_hw_number_t' before left shifting it to calculate the hardware interrupt number. Please note that this fixes the issue only on 64-bit systems and doesn't change the behavior for 32-bit systems i.e. the 32-bit systems continue to have the issue. Since the issue surfaces only if there are too many PCIe controllers in the system which usually is the case in modern server systems and they don't tend to run 32-bit kernels. Fixes: 3878eaefb89a ("PCI/MSI: Enhance core to support hierarchy irqdomain") Signed-off-by: Vidya Sagar Signed-off-by: Thomas Gleixner Tested-by: Shanker Donthineni Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20240115135649.708536-1-vidyas@nvidia.com

PCI/MSI: Use FIELD_GET/PREP()

2023-10-24T15:54:04Z

Instead of custom masking and shifting, use FIELD_GET/PREP() with register fields. Link: https://lore.kernel.org/r/20231018113254.17616-8-ilpo.jarvinen@linux.intel.com Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas

PCI: Fix typos in docs and comments

2023-08-25T13:15:38Z

Fix typos in docs and comments. Link: https://lore.kernel.org/r/20230824193712.542167-11-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Randy Dunlap Reviewed-by: Ilpo Järvinen