Re: [PATCH v3 8/8] s390/pci: Unregister the adapter interrupt first in zpci_irq_exit()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] s390/pci: UAF memory corruption in MSI setup due to missing device teardown
--

commit 4f6e192e648a7af5752afbd15f3be9f0172b9594
Author: Tobias Schumacher <ts@linux.ibm.com>

s390/pci: Unregister the adapter interrupt first in zpci_irq_exit()

This commit modifies zpci_irq_exit() to unregister the adapter interrupt before
freeing the interrupt bit vectors. This aims to prevent vectors from being
freed under a live handler during the pci_base_init() error path.

> diff --git a/arch/s390/pci/pci_irq.c b/arch/s390/pci/pci_irq.c
> index 4b8ebb987580b..16ae80ed2d139 100644
> --- a/arch/s390/pci/pci_irq.c
> +++ b/arch/s390/pci/pci_irq.c
> @@ -674,6 +674,7 @@ void __init zpci_irq_exit(void)
>  {
>  	unsigned int cpu;
>  
> +	unregister_adapter_interrupt(&zpci_airq);
>  	if (irq_delivery == DIRECTED) {
>  		for_each_possible_cpu(cpu) {
>  			airq_iv_release(zpci_dibv[cpu]);
> @@ -684,5 +685,4 @@ void __init zpci_irq_exit(void)
>  	}
>  	if (zpci_sbv)
>  		airq_iv_release(zpci_sbv);

[Severity: High]
Does this change fully resolve the use-after-free risk in the pci_base_init()
error path?

While moving unregister_adapter_interrupt() prevents the interrupt handler
from accessing the vectors while they are being freed, it appears the devices
registered earlier by zpci_scan_devices() are never unregistered when
pci_base_init() fails during zpci_fw_sysfs_init().

If a driver later binds to one of these still-registered devices and calls
pci_alloc_irq_vectors(), the PCI MSI setup accesses the freed zpci_sbv
and zpci_ibv structures:

arch/s390/pci/pci_irq.c:__alloc_airq() {
    ...
    /* Allocate adapter summary indicator bit */
    *bit = airq_iv_alloc_bit(zpci_sbv);
    ...
    /* Wire up shortcut pointer */
    rcu_assign_pointer(zpci_ibv[*bit], zdev->aibv);
    ...
}

Could this lead to memory corruption when a driver attempts to set up MSI on
a device that was not properly torn down?

> -	unregister_adapter_interrupt(&zpci_airq);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009-s390_irq_domain_fixes-v3-0-ced19028da3c@linux.ibm.com?part=8