CVE-2024-26813
Assigner: Linux
Published: 2024-04-05T08:24:43.279Z
State: PUBLISHED
descriptions: value: In the Linux kernel, the following vulnerability has been resolved:

vfio/platform: Create persistent IRQ handlers

The vfio-platform SET_IRQS ioctl currently allows loopback triggering of
an interrupt before a signaling eventfd has been configured by the user,
which thereby allows a NULL pointer dereference.

Rather than register the IRQ relative to a valid trigger, register all
IRQs in a disabled state in the device open path.  This allows mask
operations on the IRQ to nest within the overall enable state governed
by a valid eventfd signal.  This decouples @masked, protected by the
@locked spinlock from @trigger, protected via the @igate mutex.

In doing so, it's guaranteed that changes to @trigger cannot race the
IRQ handlers because the IRQ handler is synchronously disabled before
modifying the trigger, and loopback triggering of the IRQ via ioctl is
safe due to serialization with trigger changes via igate.

For compatibility, request_irq() failures are maintained to be local to
the SET_IRQS ioctl rather than a fatal error in the open device path.
This allows, for example, a userspace driver with polling mode support
to continue to work regardless of moving the request_irq() call site.
This necessarily blocks all SET_IRQS access to the failed index.
affected: product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 57f972e2b341
lessThan: 07afdfd8a68f
status: affected
versionType: git
version: 57f972e2b341
lessThan: 09452c8fcbd7
status: affected
versionType: git
version: 57f972e2b341
lessThan: cc5838f19d39
status: affected
versionType: git
version: 57f972e2b341
lessThan: 7932db06c82c
status: affected
versionType: git
version: 57f972e2b341
lessThan: 62d4e43a569b
status: affected
versionType: git
version: 57f972e2b341
lessThan: d6bedd6acc0b
status: affected
versionType: git
version: 57f972e2b341
lessThan: 0f8d8f9c2173
status: affected
versionType: git
version: 57f972e2b341
lessThan: 675daf435e9f
status: affected
versionType: git
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 4.1
status: affected
version: 0
lessThan: 4.1
status: unaffected
versionType: custom
version: 5.4.274
lessThanOrEqual: 5.4.*
status: unaffected
versionType: custom
version: 5.10.215
lessThanOrEqual: 5.10.*
status: unaffected
versionType: custom
version: 5.15.154
lessThanOrEqual: 5.15.*
status: unaffected
versionType: custom
version: 6.1.84
lessThanOrEqual: 6.1.*
status: unaffected
versionType: custom
version: 6.6.24
lessThanOrEqual: 6.6.*
status: unaffected
versionType: custom
version: 6.7.12
lessThanOrEqual: 6.7.*
status: unaffected
versionType: custom
version: 6.8.3
lessThanOrEqual: 6.8.*
status: unaffected
versionType: custom
version: 6.9
lessThanOrEqual: *
status: unaffected
versionType: original_commit_for_fix
title: vfio/platform: Create persistent IRQ handlers
x_generator: engine: bippy-d175d3acf727