In the Linux kernel, the following vulnerability has been resolved:
PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free
Struct pcielinkstate->downstream is a pointer to the pci_dev of function 0. Previously we retained that pointer when removing function 0, and subsequent ASPM policy changes dereferenced it, resulting in a use-after-free warning from KASAN, e.g.:
# echo 1 > /sys/bus/pci/devices/0000:03:00.0/remove # echo powersave > /sys/module/pcie_aspm/parameters/policy
BUG: KASAN: slab-use-after-free in pcieconfigaspmlink+0x42d/0x500 Call Trace: kasanreport+0xae/0xe0 pcieconfigaspmlink+0x42d/0x500 pcieaspmsetpolicy+0x8e/0x1a0 paramattrstore+0x162/0x2c0 moduleattrstore+0x3e/0x80
PCIe spec r6.0, sec 7.5.3.7, recommends that software program the same ASPM Control value in all functions of multi-function devices.
Disable ASPM and free the pcielinkstate when any child function is removed so we can discard the dangling pcielinkstate->downstream pointer and maintain the same ASPM Control configuration for all functions.
[bhelgaas: commit log and comment]
[
{
"target": {
"file": "drivers/pci/pcie/aspm.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"243291515172356700990126390020866699661",
"128289395338071990827652203449722055090",
"63780704999667351561538456699693029704",
"334053473466160846936290874487879482689",
"154549833137510169774166708048848940486",
"112787060212163265051236170782845909931",
"133603423990591883427847465000198088783",
"246852587362564428044521033792571923234",
"286147428703670499408994418305186023944",
"253350776058433824203199798550413560936",
"114308821607944191194505864274937943735",
"196633351330923818866904730124328430700",
"168831323186606572969387684814364023957",
"68948106601505679747318491751657146512"
]
},
"deprecated": false,
"id": "CVE-2023-53446-0cffa3b6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9856c0de49052174ab474113f4ba40c02aaee086"
},
{
"target": {
"function": "pcie_aspm_exit_link_state",
"file": "drivers/pci/pcie/aspm.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "154847610831810727784547230811010877908",
"length": 522.0
},
"deprecated": false,
"id": "CVE-2023-53446-18bc9e96",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7aecdd47910c51707696e8b0e045b9f88bd4230f"
},
{
"target": {
"function": "pcie_aspm_exit_link_state",
"file": "drivers/pci/pcie/aspm.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "154847610831810727784547230811010877908",
"length": 522.0
},
"deprecated": false,
"id": "CVE-2023-53446-5896e67c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d51d2eeae4ce54d542909c4d9d07bf371a78592c"
},
{
"target": {
"function": "pcie_aspm_exit_link_state",
"file": "drivers/pci/pcie/aspm.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "154847610831810727784547230811010877908",
"length": 522.0
},
"deprecated": false,
"id": "CVE-2023-53446-5fc9ea44",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9856c0de49052174ab474113f4ba40c02aaee086"
},
{
"target": {
"function": "pcie_aspm_exit_link_state",
"file": "drivers/pci/pcie/aspm.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "154847610831810727784547230811010877908",
"length": 522.0
},
"deprecated": false,
"id": "CVE-2023-53446-72b6fe85",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7badf4d6f49a358a01ab072bbff88d3ee886c33b"
},
{
"target": {
"file": "drivers/pci/pcie/aspm.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"243291515172356700990126390020866699661",
"128289395338071990827652203449722055090",
"63780704999667351561538456699693029704",
"334053473466160846936290874487879482689",
"154549833137510169774166708048848940486",
"112787060212163265051236170782845909931",
"133603423990591883427847465000198088783",
"246852587362564428044521033792571923234",
"286147428703670499408994418305186023944",
"253350776058433824203199798550413560936",
"114308821607944191194505864274937943735",
"196633351330923818866904730124328430700",
"168831323186606572969387684814364023957",
"68948106601505679747318491751657146512"
]
},
"deprecated": false,
"id": "CVE-2023-53446-9e5c72d0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7badf4d6f49a358a01ab072bbff88d3ee886c33b"
},
{
"target": {
"file": "drivers/pci/pcie/aspm.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"243291515172356700990126390020866699661",
"128289395338071990827652203449722055090",
"63780704999667351561538456699693029704",
"334053473466160846936290874487879482689",
"154549833137510169774166708048848940486",
"112787060212163265051236170782845909931",
"133603423990591883427847465000198088783",
"246852587362564428044521033792571923234",
"286147428703670499408994418305186023944",
"253350776058433824203199798550413560936",
"114308821607944191194505864274937943735",
"196633351330923818866904730124328430700",
"168831323186606572969387684814364023957",
"68948106601505679747318491751657146512"
]
},
"deprecated": false,
"id": "CVE-2023-53446-a5a08271",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d51d2eeae4ce54d542909c4d9d07bf371a78592c"
},
{
"target": {
"file": "drivers/pci/pcie/aspm.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"243291515172356700990126390020866699661",
"128289395338071990827652203449722055090",
"63780704999667351561538456699693029704",
"334053473466160846936290874487879482689",
"154549833137510169774166708048848940486",
"112787060212163265051236170782845909931",
"133603423990591883427847465000198088783",
"246852587362564428044521033792571923234",
"286147428703670499408994418305186023944",
"253350776058433824203199798550413560936",
"114308821607944191194505864274937943735",
"196633351330923818866904730124328430700",
"168831323186606572969387684814364023957",
"68948106601505679747318491751657146512"
]
},
"deprecated": false,
"id": "CVE-2023-53446-f5ce1ed9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7aecdd47910c51707696e8b0e045b9f88bd4230f"
}
]