Commit 1ec6863
irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
jira VULN-162593
cve CVE-2025-37819
commit-author Suzuki K Poulose <suzuki.poulose@arm.com>
commit 3318dc2
With ACPI in place, gicv2m_get_fwnode() is registered with the pci
subsystem as pci_msi_get_fwnode_cb(), which may get invoked at runtime
during a PCI host bridge probe. But, the call back is wrongly marked as
__init, causing it to be freed, while being registered with the PCI
subsystem and could trigger:
Unable to handle kernel paging request at virtual address ffff8000816c0400
gicv2m_get_fwnode+0x0/0x58 (P)
pci_set_bus_msi_domain+0x74/0x88
pci_register_host_bridge+0x194/0x548
This is easily reproducible on a Juno board with ACPI boot.
Retain the function for later use.
Fixes: 0644b3d ("irqchip/gic-v2m: acpi: Introducing GICv2m ACPI support")
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
(cherry picked from commit 3318dc2)
Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>1 parent 072f071 commit 1ec6863
1 file changed
Lines changed: 1 addition & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
454 | 454 | | |
455 | 455 | | |
456 | 456 | | |
457 | | - | |
| 457 | + | |
458 | 458 | | |
459 | 459 | | |
460 | 460 | | |
| |||
0 commit comments