[SRU][N][PATCH 0/1] CVE-2024-58093

[Masahiro Yamada]

[Impact]

    PCI/ASPM: Fix link state exit during switch upstream function removal
    
    Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to
    avoid use-after-free"), we would free the ASPM link only after the last
    function on the bus pertaining to the given link was removed.
    
    That was too late. If function 0 is removed before sibling function,
    link->downstream would point to free'd memory after.
    
    After above change, we freed the ASPM parent link state upon any function
    removal on the bus pertaining to a given link.
    
    That is too early. If the link is to a PCIe switch with MFD on the upstream
    port, then removing functions other than 0 first would free a link which
    still remains parent_link to the remaining downstream ports.
    
    The resulting GPFs are especially frequent during hot-unplug, because
    pciehp removes devices on the link bus in reverse order.
    
    On that switch, function 0 is the virtual P2P bridge to the internal bus.
    Free exactly when function 0 is removed -- before the parent link is
    obsolete, but after all subordinate links are gone.

[Fix]

Noble:    Sent to ML (this patch set)
Jammy:    Backported (WIP
Focal:    Fixed already
Bionic:   Not affected
Xenial:   Not affected
Trusty:   Not affected

[Test Case]

Compile and boot tested. 'lspci' was OK.

[Where problems could occur]

This fix affects PCIe.

Daniel Stodden (1):
  PCI/ASPM: Fix link state exit during switch upstream function removal

 drivers/pci/pcie/aspm.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

-- 
2.43.0