Re: [PATCH] pci: fix uaf for resource file

Re: [PATCH] pci: fix uaf for resource file

[Danilo Krummrich]

On 6/29/25 5:05 AM, zhangjian wrote:
> concurrently creating attr files may cause uaf. We meet this in concurrently
> plug and unplug network card.

Not exactly sure how you got to this specific list of recipients, but you should
also send the patch to Bjorn Helgaas <bhelgaas@google.com>.

Otherwise, please use scripts/get_maintainer.pl to find the list of required
recipients.

[PATCH] pci: fix uaf for resource file

[zhangjian]

concurrently creating attr files may cause uaf. We meet this in concurrently
plug and unplug network card. For example:

echo 20 > /sys/class/net/eth3/device/sriov_numvfs &
echo 1 > /sys/bus/pci/rescan

crash log snips as following:

Call Trace:
 <TASK>
 ? _die_body+0x1a/0xe0
 ? page_fault_oops+0x81/0x150
 ? _wake_up_sync_key+0x37/0x50
 ? exc_page_fault+0x525/0x730
 ? asm_exc_page_fault+0x22/0x30
 ? pci_create_attr+0x160/0x180
 ? pfx_strlen+0x10/0x10
 kernfs_name_hash+0x12/0x80
 kernfs_find_ns+0x35/0xc0
 kernfs_remove_by_name_ns+0x46/0xc0
 pci_stop_bus_device+0x7c/0x90
 pci_stop_and_remole_bus_device+0xe/0x20
 pci_iov_remove_virtfn+0xbd/0x120
 sriov_disable+0x34/0xe0
 hinic_pci_sriov_diisable+0x35/0xa0 [hinic]
 hinic_remove+0x22e/0x2a0 [hinic]
 pci_device_remove+0x3b/0xb0
 device_release_driver_internal+0x19b/0x200
 pci_stop_bus_device+0x6c/0x90
 pci_stop_and_remolre_bus_device_locked+0x16/0x30
 remove_store+0xfc/0x130
 kernfs_fop_write_iter+0x11b/0x200

set resource pointer to zero to fix this problem.

Signed-off-by: zhangjian <zhangjian496@huawei.com>
---
 drivers/pci/pci-sysfs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 268c69daa..12dba9228 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -1180,12 +1180,14 @@ static void pci_remove_resource_files(struct pci_dev *pdev)
 		if (res_attr) {
 			sysfs_remove_bin_file(&pdev->dev.kobj, res_attr);
 			kfree(res_attr);
+			pdev->res_attr[i] = NULL;
 		}
 
 		res_attr = pdev->res_attr_wc[i];
 		if (res_attr) {
 			sysfs_remove_bin_file(&pdev->dev.kobj, res_attr);
 			kfree(res_attr);
+			pdev->res_attr_wc[i] = NULL;
 		}
 	}
 }
-- 
2.33.0