Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2024-58093

PCI/ASPM: Fix link state exit during switch upstream function removal

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix link state exit during switch upstream function removal Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free"), we would free the ASPM link only after the last function on the bus pertaining to the given link was removed. That was too late. If function 0 is removed before sibling function, link->downstream would point to free'd memory after. After above change, we freed the ASPM parent link state upon any function removal on the bus pertaining to a given link. That is too early. If the link is to a PCIe switch with MFD on the upstream port, then removing functions other than 0 first would free a link which still remains parent_link to the remaining downstream ports. The resulting GPFs are especially frequent during hot-unplug, because pciehp removes devices on the link bus in reverse order. On that switch, function 0 is the virtual P2P bridge to the internal bus. Free exactly when function 0 is removed -- before the parent link is obsolete, but after all subordinate links are gone. [kwilczynski: commit log]

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 666e7f9d60cee23077ea3e6331f6f8a19f7ea03f to < 0a0f9aecf66b98959aab7fb5764b4b3e522f4f5baffected
  • 7badf4d6f49a358a01ab072bbff88d3ee886c33b to < 62db339ecc3d58d8fd83a9e4d80061cd943bb6e2affected
  • 9856c0de49052174ab474113f4ba40c02aaee086 to < e5cd58f61e9d8024ee11bd78c12c8916891d4077affected
  • 7aecdd47910c51707696e8b0e045b9f88bd4230f to < cd4b07507794f7ad1a74e12eca75121d98187e66affected
  • 456d8aa37d0f56fc9e985e812496e861dcd6f2f2 to < 8b930ddc2044e36866c41423e89889e0258695a3affected
  • 456d8aa37d0f56fc9e985e812496e861dcd6f2f2 to < f556b6ba0ac5f8353287ce6ed761228f0b4fafb7affected
  • 456d8aa37d0f56fc9e985e812496e861dcd6f2f2 to < ba4cdc14c0d4df00d3e99bff7fe545303db98183affected
  • 456d8aa37d0f56fc9e985e812496e861dcd6f2f2 to < 4d96930239981f312821a4065db8cc0f8240a173affected
  • 456d8aa37d0f56fc9e985e812496e861dcd6f2f2 to < cbf937dcadfd571a434f8074d057b32cd14fbea5affected
  • d51d2eeae4ce54d542909c4d9d07bf371a78592caffected
  • 4203722d51afe3d239e03f15cc73efdf023a7103affected
  • 5.4.251 to < 5.4.292affected
  • 5.10.188 to < 5.10.236affected
  • 5.15.121 to < 5.15.180affected
  • 6.1.39 to < 6.1.134affected
  • 6.3.13 to < 6.4affected
  • 6.4.4 to < 6.5affected

Linux Linux

Default version status: affected

  • 6.5affected
  • 0 to < 6.5unaffected
  • 5.4.292 to ≤ 5.4.*unaffected
  • 5.10.236 to ≤ 5.10.*unaffected
  • 5.15.180 to ≤ 5.15.*unaffected
  • 6.1.134 to ≤ 6.1.*unaffected
  • 6.6.87 to ≤ 6.6.*unaffected
  • 6.12.23 to ≤ 6.12.*unaffected
  • 6.13.11 to ≤ 6.13.*unaffected
  • 6.14.2 to ≤ 6.14.*unaffected
  • 6.15 to ≤ *unaffected

References