In the Linux kernel, the following vulnerability has been resolved:
PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free
Struct pcielinkstate->downstream is a pointer to the pci_dev of function 0. Previously we retained that pointer when removing function 0, and subsequent ASPM policy changes dereferenced it, resulting in a use-after-free warning from KASAN, e.g.:
# echo 1 > /sys/bus/pci/devices/0000:03:00.0/remove # echo powersave > /sys/module/pcie_aspm/parameters/policy
BUG: KASAN: slab-use-after-free in pcieconfigaspmlink+0x42d/0x500 Call Trace: kasanreport+0xae/0xe0 pcieconfigaspmlink+0x42d/0x500 pcieaspmsetpolicy+0x8e/0x1a0 paramattrstore+0x162/0x2c0 moduleattrstore+0x3e/0x80
PCIe spec r6.0, sec 7.5.3.7, recommends that software program the same ASPM Control value in all functions of multi-function devices.
Disable ASPM and free the pcielinkstate when any child function is removed so we can discard the dangling pcielinkstate->downstream pointer and maintain the same ASPM Control configuration for all functions.
[bhelgaas: commit log and comment]
{ "vanir_signatures": [ { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/pci/pcie/aspm.c" }, "id": "CVE-2023-53446-0cffa3b6", "digest": { "line_hashes": [ "243291515172356700990126390020866699661", "128289395338071990827652203449722055090", "63780704999667351561538456699693029704", "334053473466160846936290874487879482689", "154549833137510169774166708048848940486", "112787060212163265051236170782845909931", "133603423990591883427847465000198088783", "246852587362564428044521033792571923234", "286147428703670499408994418305186023944", "253350776058433824203199798550413560936", "114308821607944191194505864274937943735", "196633351330923818866904730124328430700", "168831323186606572969387684814364023957", "68948106601505679747318491751657146512" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9856c0de49052174ab474113f4ba40c02aaee086" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/pci/pcie/aspm.c" }, "id": "CVE-2023-53446-14d14720", "digest": { "line_hashes": [ "243291515172356700990126390020866699661", "128289395338071990827652203449722055090", "63780704999667351561538456699693029704", "334053473466160846936290874487879482689", "154549833137510169774166708048848940486", "112787060212163265051236170782845909931", "133603423990591883427847465000198088783", "246852587362564428044521033792571923234", "286147428703670499408994418305186023944", "253350776058433824203199798550413560936", "114308821607944191194505864274937943735", "196633351330923818866904730124328430700", "168831323186606572969387684814364023957", "68948106601505679747318491751657146512" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4203722d51afe3d239e03f15cc73efdf023a7103" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/pci/pcie/aspm.c", "function": "pcie_aspm_exit_link_state" }, "id": "CVE-2023-53446-18bc9e96", "digest": { "length": 522.0, "function_hash": "154847610831810727784547230811010877908" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7aecdd47910c51707696e8b0e045b9f88bd4230f" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/pci/pcie/aspm.c", "function": "pcie_aspm_exit_link_state" }, "id": "CVE-2023-53446-5896e67c", "digest": { "length": 522.0, "function_hash": "154847610831810727784547230811010877908" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d51d2eeae4ce54d542909c4d9d07bf371a78592c" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/pci/pcie/aspm.c", "function": "pcie_aspm_exit_link_state" }, "id": "CVE-2023-53446-5fc9ea44", "digest": { "length": 522.0, "function_hash": "154847610831810727784547230811010877908" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9856c0de49052174ab474113f4ba40c02aaee086" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/pci/pcie/aspm.c", "function": "pcie_aspm_exit_link_state" }, "id": "CVE-2023-53446-72b6fe85", "digest": { "length": 522.0, "function_hash": "154847610831810727784547230811010877908" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7badf4d6f49a358a01ab072bbff88d3ee886c33b" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/pci/pcie/aspm.c" }, "id": "CVE-2023-53446-9e5c72d0", "digest": { "line_hashes": [ "243291515172356700990126390020866699661", "128289395338071990827652203449722055090", "63780704999667351561538456699693029704", "334053473466160846936290874487879482689", "154549833137510169774166708048848940486", "112787060212163265051236170782845909931", "133603423990591883427847465000198088783", "246852587362564428044521033792571923234", "286147428703670499408994418305186023944", "253350776058433824203199798550413560936", "114308821607944191194505864274937943735", "196633351330923818866904730124328430700", "168831323186606572969387684814364023957", "68948106601505679747318491751657146512" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7badf4d6f49a358a01ab072bbff88d3ee886c33b" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/pci/pcie/aspm.c" }, "id": "CVE-2023-53446-a5a08271", "digest": { "line_hashes": [ "243291515172356700990126390020866699661", "128289395338071990827652203449722055090", "63780704999667351561538456699693029704", "334053473466160846936290874487879482689", "154549833137510169774166708048848940486", "112787060212163265051236170782845909931", "133603423990591883427847465000198088783", "246852587362564428044521033792571923234", "286147428703670499408994418305186023944", "253350776058433824203199798550413560936", "114308821607944191194505864274937943735", "196633351330923818866904730124328430700", "168831323186606572969387684814364023957", "68948106601505679747318491751657146512" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d51d2eeae4ce54d542909c4d9d07bf371a78592c" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/pci/pcie/aspm.c", "function": "pcie_aspm_exit_link_state" }, "id": "CVE-2023-53446-b45dfe92", "digest": { "length": 522.0, "function_hash": "154847610831810727784547230811010877908" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4203722d51afe3d239e03f15cc73efdf023a7103" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/pci/pcie/aspm.c" }, "id": "CVE-2023-53446-b81129f7", "digest": { "line_hashes": [ "243291515172356700990126390020866699661", "128289395338071990827652203449722055090", "63780704999667351561538456699693029704", "334053473466160846936290874487879482689", "154549833137510169774166708048848940486", "112787060212163265051236170782845909931", "133603423990591883427847465000198088783", "246852587362564428044521033792571923234", "286147428703670499408994418305186023944", "253350776058433824203199798550413560936", "114308821607944191194505864274937943735", "196633351330923818866904730124328430700", "168831323186606572969387684814364023957", "68948106601505679747318491751657146512" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@666e7f9d60cee23077ea3e6331f6f8a19f7ea03f" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/pci/pcie/aspm.c", "function": "pcie_aspm_exit_link_state" }, "id": "CVE-2023-53446-bc4211c9", "digest": { "length": 522.0, "function_hash": "154847610831810727784547230811010877908" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@666e7f9d60cee23077ea3e6331f6f8a19f7ea03f" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/pci/pcie/aspm.c" }, "id": "CVE-2023-53446-f5ce1ed9", "digest": { "line_hashes": [ "243291515172356700990126390020866699661", "128289395338071990827652203449722055090", "63780704999667351561538456699693029704", "334053473466160846936290874487879482689", "154549833137510169774166708048848940486", "112787060212163265051236170782845909931", "133603423990591883427847465000198088783", "246852587362564428044521033792571923234", "286147428703670499408994418305186023944", "253350776058433824203199798550413560936", "114308821607944191194505864274937943735", "196633351330923818866904730124328430700", "168831323186606572969387684814364023957", "68948106601505679747318491751657146512" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7aecdd47910c51707696e8b0e045b9f88bd4230f" } ] }