PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() in Kernel

Background

The Kernel is an open-source software that serves as the core component of the Linux operating system. It provides essential functionalities and interfaces for hardware devices, drivers, and system processes. The Kernel is responsible for managing and controlling the communication between software and hardware components. This vulnerability affects the Kernel and specifically relates to the PCI subsystem.

The PCI subsystem in the Kernel handles the communication and configuration of peripheral devices connected to the computer's PCI bus. It provides a set of functions and data structures for device enumeration, driver binding, and resource allocation. The vulnerability in question involves a potential deadlock scenario when accessing the sriov_numvfs_store() function, which is responsible for configuring the number of Virtual Functions (VFs) for a Single Root I/O Virtualization (SR-IOV) device.

Vulnerability Detail

The vulnerability arises due to a potential AB/BA deadlock situation when acquiring the pci_dev_lock() lock in the sriov_numvfs_store() function. This can occur when multiple threads or processes attempt to modify the number of VFs concurrently. The deadlock scenario can lead to a system freeze or unresponsiveness, impacting the stability and availability of the affected system.

The vulnerability has been assigned the ID GSD-2022-1003047 and has been fixed in Linux Kernel version v5.17.14 by commit ea047f51172aa68841adef7f52d375002438b8f0.

Workaround

As a workaround, users can avoid triggering the deadlock scenario by ensuring that only one thread or process modifies the number of VFs at a time. This can be achieved by implementing a synchronization mechanism, such as a lock or semaphore, to serialize access to the sriov_numvfs_store() function. The following code snippet demonstrates a possible implementation using a mutex lock:

#include <linux/mutex.h>

static DEFINE_MUTEX(sriov_numvfs_mutex);

static ssize_t sriov_numvfs_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count) {
    ssize_t ret;

    mutex_lock(&sriov_numvfs_mutex);
    ret = __sriov_numvfs_store(dev, attr, buf, count);
    mutex_unlock(&sriov_numvfs_mutex);

    return ret;
}

Conclusion

In conclusion, the vulnerability in the Kernel's PCI subsystem related to the sriov_numvfs_store() function can lead to a deadlock scenario, causing system freeze or unresponsiveness. It is crucial to update the Kernel to version v5.17.14 or later to mitigate this vulnerability. Alternatively, implementing a synchronization mechanism can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for Kernel →

FAQ