title: platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe
description: In the Linux kernel, the following vulnerability has been resolved:
platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe
p2sb_bar() unhides P2SB device to get resources from the device. It
guards the operation by locking pci_rescan_remove_lock so that parallel
rescans do not find the P2SB device. However, this lock causes deadlock
when PCI bus rescan is triggered by /sys/bus/pci/rescan. The rescan
locks pci_rescan_remove_lock and probes PCI devices. When PCI devices
call p2sb_bar() during probe, it locks pci_rescan_remove_lock again.
Hence the deadlock.
To avoid the deadlock, do not lock pci_rescan_remove_lock in p2sb_bar().
Instead, do the lock at fs_initcall. Introduce p2sb_cache_resources()
for fs_initcall which gets and caches the P2SB resources. At p2sb_bar(),
refer the cache and return to the caller.
Before operating the device at P2SB DEVFN for resource cache, check
that its device class is PCI_CLASS_MEMORY_OTHER 0x0580 that PCH
specifications define. This avoids unexpected operation to other devices
at the same DEVFN.
Tested-by Klara Modin <klarasmodin@gmail.com>
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 9745fb07474f, lessThan: 2841631a0365, status: affected, versionType: git
version: 9745fb07474f, lessThan: 847e1eb30e26, status: affected, versionType: git
version: 9745fb07474f, lessThan: d281ac9a987c, status: affected, versionType: git
version: 9745fb07474f, lessThan: 5913320eb0b3, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 6.0, status: affected
version: 0, lessThan: 6.0, status: unaffected, versionType: custom
version: 6.1.76, lessThanOrEqual: 6.1.*, status: unaffected, versionType: custom
version: 6.6.15, lessThanOrEqual: 6.6.*, status: unaffected, versionType: custom
version: 6.7.3, lessThanOrEqual: 6.7.*, status: unaffected, versionType: custom
version: 6.8, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
