In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems<\/p>\n
On 32-bit systems the config space is too large to ioremap in one go, so
\npci_ecam_create() maps each bus segment separately and relies on the
\n->add_bus callback (pci_ecam_add_bus) to populate the per-bus mapping in
\ncfg->winp[]. pci_ecam_map_bus() then uses that mapping as the base for
\nevery config access.<\/p>\n
The generic ECAM ops (pci_generic_ecam_ops) already provide the ->add_bus
\nand ->remove_bus callbacks, but the CAM (legacy) ops in pci-host-generic.c
\ndo not. As a result, on a 32-bit host using “pci-host-cam-generic” the
\nper-bus mapping is never set up and the first config read dereferences a
\nNULL base, crashing during bus enumeration:<\/p>\n
Unable to handle kernel NULL pointer dereference at virtual address 00000800
\n Oops [#1]
\n CPU: 0 PID: 1 Comm: swapper Not tainted 6.9.7+ #43
\n Hardware name: Digilent Nexys-Video-A7 RV32 (DT)
\n epc : pci_generic_config_read+0x40\/0xb0
\n ra : pci_generic_config_read+0x2c\/0xb0
\n [] pci_generic_config_read+0x40\/0xb0
\n [] pci_bus_read_config_dword+0x50\/0xb0
\n [] pci_bus_generic_read_dev_vendor_id+0x3c\/0x1ec
\n [] pci_scan_single_device+0xa4\/0x11c
\n [] pci_scan_slot+0x9c\/0x23c
\n [] pci_scan_child_bus_extend+0x58\/0x2f4
\n [] pci_scan_root_bus_bridge+0x64\/0xe8
\n [] pci_host_probe+0x20\/0xc8
\n [] pci_host_common_probe+0x144\/0x1e4<\/p>\n
Fix this by giving the CAM ops the same ->add_bus\/->remove_bus callbacks.
\nSince pci_ecam_add_bus() and pci_ecam_remove_bus() are static to ecam.c,
\nmove the CAM ops definition there as pci_generic_cam_ops (mirroring
\npci_generic_ecam_ops) and export it for pci-host-generic.c to reference.<\/p>\n
[mani: removed timestamp from log]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems<\/p>\n
On 32-bit systems the config space is too large to ioremap i<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-20400","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/20400","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=20400"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=20400"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=20400"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}