github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

xen/pcifront: check that an AER callback exists before calling it

Browse Source 
pcifront_common_process() handles an AER request from the backend by
dispatching on aer_op.cmd to the bound driver's PCI error handler.  It
only checks that err_handler and err_handler->error_detected are present,
then for the mmio_enabled, slot_reset and resume commands it calls the
corresponding callback unconditionally.  Those three callbacks are
optional -- the PCI core NULL-checks each of them individually before
use -- and many drivers (for example igb, igc, ice and ixgbevf) install
error_detected without all of them.

aer_op.cmd comes from the shared ring, so a malicious or buggy backend
can send XEN_PCI_OP_aer_mmio (or _slotreset/_resume) for a device whose
driver leaves that callback NULL and make the frontend call through a
NULL pointer, crashing the guest.

Check each callback before calling it.  When mmio_enabled or slot_reset is
absent, return PCI_ERS_RESULT_RECOVERED so recovery proceeds, as the PCI
core does for a missing callback; returning PCI_ERS_RESULT_NONE would
instead make xen-pciback tear the guest domain down.

Fixes: 956a9202cd ("xen-pcifront: Xen PCI frontend driver.")
Cc: stable@vger.kernel.org
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Reviewed-by: Juergen Gross <jgross@suse.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20261006023443.338194-1-yhlee@isslab.korea.ac.kr>
This commit is contained in:
Yehyeong Lee 2026-10-06 11:34:43 +09:00 committed by Juergen Gross
parent 6f165abe2b
commit 3b4854b69e
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/pci/xen-pcifront.c
View File

@ -598,11 +598,16 @@ static pci_ers_result_t pcifront_common_process(int cmd,
case XEN_PCI_OP_aer_detected:
return pdrv->err_handler->error_detected(pcidev, state);
case XEN_PCI_OP_aer_mmio:
return pdrv->err_handler->mmio_enabled(pcidev);
if (pdrv->err_handler->mmio_enabled)
return pdrv->err_handler->mmio_enabled(pcidev);
return PCI_ERS_RESULT_RECOVERED;
case XEN_PCI_OP_aer_slotreset:
return pdrv->err_handler->slot_reset(pcidev);
if (pdrv->err_handler->slot_reset)
return pdrv->err_handler->slot_reset(pcidev);
return PCI_ERS_RESULT_RECOVERED;
case XEN_PCI_OP_aer_resume:
pdrv->err_handler->resume(pcidev);
if (pdrv->err_handler->resume)
pdrv->err_handler->resume(pcidev);
return PCI_ERS_RESULT_NONE;
default:
dev_err(&pdev->xdev->dev,