CVE-2021-47617

The Power Fault Detected bit in the Slot Status register differs from all other hotplug events in that it is sticky: It can only be cleared after turning off slot power. Per PCIe r5.0, sec. 6.7.1.8:

If a power controller detects a main power fault on the hot-plug slot, it must automatically set its internal main power fault latch [...]. The main power fault latch is cleared when software turns off power to the hot-plug slot.

The stickiness used to cause interrupt storms and infinite loops which were fixed in 2009 by commits 5651c48cfafe ("PCI pciehp: fix power fault interrupt storm problem") and 99f0169c17f3 ("PCI: pciehp: enable software notification on empty slots").

Unfortunately in 2020 the infinite loop issue was inadvertently reintroduced by commit 8edf5332c393 ("PCI: pciehp: Fix MSI interrupt race"): The hardirq handler pciehp_isr() clears the PFD bit until pciehp's power_fault_detected flag is set. That happens in the IRQ thread pciehp_ist(), which never learns of the event because the hardirq handler is stuck in an infinite loop. Fix by setting the power_fault_detected flag already in the hardirq handler.

References

Affected packages

Git /

Affected ranges

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-47617.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "4.19.149"
            },
            {
                "fixed": "4.19.233"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "5.4.69"
            },
            {
                "fixed": "5.4.177"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "5.7"
            },
            {
                "fixed": "5.10.97"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "5.11"
            },
            {
                "fixed": "5.15.20"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "5.16"
            },
            {
                "fixed": "5.16.6"
            }
        ]
    }
]