PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() in Kernel

Background

The Kernel is a fundamental component of the Linux operating system that provides core functionalities and interfaces with hardware devices. It manages the communication between software and hardware, including the PCI subsystem responsible for managing peripheral devices connected to the computer. The sriov_numvfs_store() function in the Kernel is used to configure the number of Virtual Functions (VFs) for a Single Root I/O Virtualization (SR-IOV) device. However, a vulnerability exists in the implementation of this function that can lead to a deadlock scenario, specifically an AB/BA deadlock, when multiple processes attempt to modify the number of VFs simultaneously. This vulnerability can potentially impact the stability and performance of systems utilizing SR-IOV devices.

Vulnerability Detail

The vulnerability arises due to a deadlock scenario caused by the pci_dev_lock() function, which is used to synchronize access to PCI device structures. When multiple processes attempt to modify the number of VFs for an SR-IOV device concurrently, a deadlock can occur if the processes acquire the pci_dev_lock() in different orderings. This AB/BA deadlock can result in a system freeze or unresponsiveness. The impact of this vulnerability depends on the specific system configuration and the frequency of concurrent modifications to the number of VFs. It is important to note that the actual attack plausibility and exploitability of this vulnerability have not been proven.

Workaround

As a workaround, users can avoid concurrent modifications to the number of VFs for SR-IOV devices. This can be achieved by ensuring that only one process at a time performs the modification, or by implementing a locking mechanism to serialize access to the sriov_numvfs_store() function. Here is an example of a possible locking mechanism using a mutex:

#include <linux/mutex.h>

static DEFINE_MUTEX(sriov_numvfs_mutex);

static ssize_t sriov_numvfs_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
{
    mutex_lock(&sriov_numvfs_mutex);

    // Perform the modification to the number of VFs

    mutex_unlock(&sriov_numvfs_mutex);

    return count;
}

Conclusion

The vulnerability in the Kernel's sriov_numvfs_store() function can lead to an AB/BA deadlock scenario when multiple processes attempt to modify the number of VFs for SR-IOV devices concurrently. This can result in system freezes or unresponsiveness. It is recommended to update the Kernel to version v5.10.121 or a later stable release to mitigate this vulnerability. Users can also implement a workaround to avoid concurrent modifications or use a locking mechanism to serialize access to the vulnerable function. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for Kernel →

FAQ