APPLIED: [SRU][N][PATCH 0/1] CVE-2024-58093

[Stefan Bader]

On 23.06.25 13:30, Masahiro Yamada wrote:
> [Impact]
> 
>      PCI/ASPM: Fix link state exit during switch upstream function removal
>      
>      Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to
>      avoid use-after-free"), we would free the ASPM link only after the last
>      function on the bus pertaining to the given link was removed.
>      
>      That was too late. If function 0 is removed before sibling function,
>      link->downstream would point to free'd memory after.
>      
>      After above change, we freed the ASPM parent link state upon any function
>      removal on the bus pertaining to a given link.
>      
>      That is too early. If the link is to a PCIe switch with MFD on the upstream
>      port, then removing functions other than 0 first would free a link which
>      still remains parent_link to the remaining downstream ports.
>      
>      The resulting GPFs are especially frequent during hot-unplug, because
>      pciehp removes devices on the link bus in reverse order.
>      
>      On that switch, function 0 is the virtual P2P bridge to the internal bus.
>      Free exactly when function 0 is removed -- before the parent link is
>      obsolete, but after all subordinate links are gone.
> 
> [Fix]
> 
> Noble:    Sent to ML (this patch set)
> Jammy:    Backported (WIP
> Focal:    Fixed already
> Bionic:   Not affected
> Xenial:   Not affected
> Trusty:   Not affected
> 
> [Test Case]
> 
> Compile and boot tested. 'lspci' was OK.
> 
> [Where problems could occur]
> 
> This fix affects PCIe.
> 
> Daniel Stodden (1):
>    PCI/ASPM: Fix link state exit during switch upstream function removal
> 
>   drivers/pci/pcie/aspm.c | 17 +++++++++--------
>   1 file changed, 9 insertions(+), 8 deletions(-)
> 

Applied to noble:linux/master-next. Thanks.

-Stefan

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xE8675DEECBEECEA3.asc
Type: application/pgp-keys
Size: 47863 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20250710/b7dd7279/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20250710/b7dd7279/attachment-0001.sig>