CVE-2024-46750: PCI: Add missing bridge lock to pci_bus_lock()
In the Linux kernel, the following vulnerability has been resolved:
PCI: Add missing bridge lock to pcibuslock()
One of the true positives that the cfgaccesslock lockdep effort identified is this sequence:
WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pcibridgesecondarybusreset+0x5d/0x70 RIP: 0010:pcibridgesecondarybusreset+0x5d/0x70 Call Trace: <TASK> ? warn+0x8c/0x190 ? pcibridgesecondarybusreset+0x5d/0x70 ? reportbug+0x1f8/0x200 ? handlebug+0x3c/0x70 ? excinvalidop+0x18/0x70 ? asmexcinvalidop+0x1a/0x20 ? pcibridgesecondarybusreset+0x5d/0x70 pciresetbus+0x1d8/0x270 vmdprobe+0x778/0xa10 pcideviceprobe+0x95/0x120
Where pciresetbus() users are triggering unlocked secondary bus resets. Ironically pcibusreset(), several calls down from pciresetbus(), uses pcibuslock() before issuing the reset which locks everything but the bridge itself.
For the same motivation as adding:
bridge = pciupstreambridge(dev); if (bridge) pcidevlock(bridge);
to pciresetfunction() for the "bus" and "cxlbus" reset cases, add pcidevlock() for @bus->self to pcibuslock().
[bhelgaas: squash in recursive locking deadlock fix from Keith Busch: https://lore.kernel.org/r/20240711193650.701834-1-kbusch@meta.com]
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is CVE-2024-46750?
CVE-2024-46750 is a vulnerability in the Linux kernel related to a missing bridge lock in the pci_bus_lock function.
What versions of the Linux kernel are affected by CVE-2024-46750?
CVE-2024-46750 affects multiple Linux kernel versions from 4.19.322 up to various 6.x versions.
How do I fix CVE-2024-46750?
To fix CVE-2024-46750, upgrade to the latest patched version of the Linux kernel as recommended by your distribution.
Is CVE-2024-46750 critical?
The severity of CVE-2024-46750 may vary depending on the kernel version and configuration but it is important to apply the fix promptly.
Are there any workarounds for CVE-2024-46750?
Currently, the best practice for CVE-2024-46750 is to apply the kernel update rather than relying on workarounds.