In the Linux kernel, the following vulnerability has been resolved:
PCI: switchtec: Fix stdev_release() crash after surprise hot remove
A PCI device hot removal may occur while stdev->cdev is held open. The call to stdevrelease() then happens during close or exit, at a point way past switchtecpciremove(). Otherwise the last ref would vanish with the trailing putdevice(), just before return.
At that later point in time, the devm cleanup has already removed the stdev->mmiomrpc mapping. Also, the stdev->pdev reference was not a counted one. Therefore, in DMA mode, the iowrite32() in stdevrelease() will cause a fatal page fault, and the subsequent dmafreecoherent(), if reached, would pass a stale &stdev->pdev->dev pointer.
Fix by moving MRPC DMA shutdown into switchtecpciremove(), after stdev_kill(). Counting the stdev->pdev ref is now optional, but may prevent future accidents.
Reproducible via the script at https://lore.kernel.org/r/20231113212150.96410-1-dns@arista.com
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52617.json"
}[
{
"signature_type": "Function",
"digest": {
"length": 355.0,
"function_hash": "110998826186471696627643621735550562184"
},
"signature_version": "v1",
"target": {
"function": "stdev_release",
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8c293549946ee5078ed0ab77793cec365559355",
"id": "CVE-2023-52617-178da23c",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"76568077293536928251263387727570604374",
"5249218589935536933750265607204149921",
"130104282996839860813107438965670899274",
"175476673829494595165118783467897305850",
"335910186963356402377315925260549824839",
"5679066464076109729029535223760888686",
"84095708887641616568991997721387509704",
"119584231835487084753310871838398779188",
"318777874208103608606511743712057151782",
"65444308328409026140512903930094511945",
"278657848002487287029151175658077465179",
"207151188205283749693458908771940547150",
"120117507430998728018459521879657344315",
"290276625441283421274684554820166836090",
"269412699303782720561143298561501283712",
"150408257788216622217213657655923676715",
"204532995104573566089020819689490136886",
"268419473899720708562328687199565742915",
"60897117315773415388666597129171362655",
"114886309097386661041113695244241628314",
"299230552727788334927226133530222746861",
"304638562440692254468448026940277588409",
"319241579192563312028246819167746494732",
"89450555842076454873903418304716044602",
"333394659869149684550520476574873626217"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a5d0528cf19dbf060313dffbe047bc11c90c24c",
"id": "CVE-2023-52617-1d94855b",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 355.0,
"function_hash": "110998826186471696627643621735550562184"
},
"signature_version": "v1",
"target": {
"function": "stdev_release",
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a5d0528cf19dbf060313dffbe047bc11c90c24c",
"id": "CVE-2023-52617-1f1ce995",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 1164.0,
"function_hash": "116041555433460733386272408621373733346"
},
"signature_version": "v1",
"target": {
"function": "stdev_create",
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d83c85922647758c1f1e4806a4c5c3cf591a20a",
"id": "CVE-2023-52617-236c2c8a",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 355.0,
"function_hash": "110998826186471696627643621735550562184"
},
"signature_version": "v1",
"target": {
"function": "stdev_release",
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e129c7fa7070fbce57feb0bfc5eaa65eef44b693",
"id": "CVE-2023-52617-236e1dbd",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 355.0,
"function_hash": "110998826186471696627643621735550562184"
},
"signature_version": "v1",
"target": {
"function": "stdev_release",
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d83c85922647758c1f1e4806a4c5c3cf591a20a",
"id": "CVE-2023-52617-2943ff90",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 315.0,
"function_hash": "110802628666932201378315187064408695218"
},
"signature_version": "v1",
"target": {
"function": "switchtec_pci_remove",
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df25461119d987b8c81d232cfe4411e91dcabe66",
"id": "CVE-2023-52617-299d9c0f",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 1164.0,
"function_hash": "116041555433460733386272408621373733346"
},
"signature_version": "v1",
"target": {
"function": "stdev_create",
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df25461119d987b8c81d232cfe4411e91dcabe66",
"id": "CVE-2023-52617-29f3a06d",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 355.0,
"function_hash": "110998826186471696627643621735550562184"
},
"signature_version": "v1",
"target": {
"function": "stdev_release",
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df25461119d987b8c81d232cfe4411e91dcabe66",
"id": "CVE-2023-52617-4f153d3a",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 315.0,
"function_hash": "110802628666932201378315187064408695218"
},
"signature_version": "v1",
"target": {
"function": "switchtec_pci_remove",
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff1c7e2fb9e9c3f53715fbe04d3ac47b80be7eb8",
"id": "CVE-2023-52617-585436eb",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 1172.0,
"function_hash": "107871814067871803064493033648730379159"
},
"signature_version": "v1",
"target": {
"function": "stdev_create",
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff1c7e2fb9e9c3f53715fbe04d3ac47b80be7eb8",
"id": "CVE-2023-52617-5e7cedbf",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"76568077293536928251263387727570604374",
"5249218589935536933750265607204149921",
"130104282996839860813107438965670899274",
"175476673829494595165118783467897305850",
"335910186963356402377315925260549824839",
"5679066464076109729029535223760888686",
"84095708887641616568991997721387509704",
"119584231835487084753310871838398779188",
"318777874208103608606511743712057151782",
"65444308328409026140512903930094511945",
"278657848002487287029151175658077465179",
"207151188205283749693458908771940547150",
"120117507430998728018459521879657344315",
"290276625441283421274684554820166836090",
"269412699303782720561143298561501283712",
"150408257788216622217213657655923676715",
"204532995104573566089020819689490136886",
"268419473899720708562328687199565742915",
"60897117315773415388666597129171362655",
"114886309097386661041113695244241628314",
"299230552727788334927226133530222746861",
"304638562440692254468448026940277588409",
"319241579192563312028246819167746494732",
"89450555842076454873903418304716044602",
"333394659869149684550520476574873626217"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8c293549946ee5078ed0ab77793cec365559355",
"id": "CVE-2023-52617-635d8b05",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"76568077293536928251263387727570604374",
"5249218589935536933750265607204149921",
"130104282996839860813107438965670899274",
"175476673829494595165118783467897305850",
"335910186963356402377315925260549824839",
"5679066464076109729029535223760888686",
"84095708887641616568991997721387509704",
"119584231835487084753310871838398779188",
"318777874208103608606511743712057151782",
"65444308328409026140512903930094511945",
"278657848002487287029151175658077465179",
"207151188205283749693458908771940547150",
"120117507430998728018459521879657344315",
"290276625441283421274684554820166836090",
"269412699303782720561143298561501283712",
"150408257788216622217213657655923676715",
"204532995104573566089020819689490136886",
"268419473899720708562328687199565742915",
"60897117315773415388666597129171362655",
"114886309097386661041113695244241628314",
"299230552727788334927226133530222746861",
"7752000439030186737246108155584148551",
"257959344840681508116322836658663569922",
"89450555842076454873903418304716044602",
"333394659869149684550520476574873626217"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d83c85922647758c1f1e4806a4c5c3cf591a20a",
"id": "CVE-2023-52617-6f66a664",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"76568077293536928251263387727570604374",
"5249218589935536933750265607204149921",
"130104282996839860813107438965670899274",
"175476673829494595165118783467897305850",
"335910186963356402377315925260549824839",
"5679066464076109729029535223760888686",
"84095708887641616568991997721387509704",
"119584231835487084753310871838398779188",
"318777874208103608606511743712057151782",
"65444308328409026140512903930094511945",
"278657848002487287029151175658077465179",
"207151188205283749693458908771940547150",
"120117507430998728018459521879657344315",
"290276625441283421274684554820166836090",
"269412699303782720561143298561501283712",
"150408257788216622217213657655923676715",
"204532995104573566089020819689490136886",
"268419473899720708562328687199565742915",
"60897117315773415388666597129171362655",
"114886309097386661041113695244241628314",
"299230552727788334927226133530222746861",
"7752000439030186737246108155584148551",
"257959344840681508116322836658663569922",
"89450555842076454873903418304716044602",
"333394659869149684550520476574873626217"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df25461119d987b8c81d232cfe4411e91dcabe66",
"id": "CVE-2023-52617-7675d806",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"76568077293536928251263387727570604374",
"5249218589935536933750265607204149921",
"130104282996839860813107438965670899274",
"175476673829494595165118783467897305850",
"335910186963356402377315925260549824839",
"5679066464076109729029535223760888686",
"84095708887641616568991997721387509704",
"119584231835487084753310871838398779188",
"318777874208103608606511743712057151782",
"65444308328409026140512903930094511945",
"278657848002487287029151175658077465179",
"207151188205283749693458908771940547150",
"120117507430998728018459521879657344315",
"290276625441283421274684554820166836090",
"269412699303782720561143298561501283712",
"150408257788216622217213657655923676715",
"204532995104573566089020819689490136886",
"268419473899720708562328687199565742915",
"60897117315773415388666597129171362655",
"114886309097386661041113695244241628314",
"299230552727788334927226133530222746861",
"7752000439030186737246108155584148551",
"257959344840681508116322836658663569922",
"89450555842076454873903418304716044602",
"333394659869149684550520476574873626217"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0233b836312e39a3c763fb53512b3fa455b473b3",
"id": "CVE-2023-52617-7a43af04",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 355.0,
"function_hash": "110998826186471696627643621735550562184"
},
"signature_version": "v1",
"target": {
"function": "stdev_release",
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff1c7e2fb9e9c3f53715fbe04d3ac47b80be7eb8",
"id": "CVE-2023-52617-80fd1416",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"76568077293536928251263387727570604374",
"5249218589935536933750265607204149921",
"130104282996839860813107438965670899274",
"175476673829494595165118783467897305850",
"335910186963356402377315925260549824839",
"5679066464076109729029535223760888686",
"84095708887641616568991997721387509704",
"119584231835487084753310871838398779188",
"318777874208103608606511743712057151782",
"65444308328409026140512903930094511945",
"278657848002487287029151175658077465179",
"207151188205283749693458908771940547150",
"120117507430998728018459521879657344315",
"290276625441283421274684554820166836090",
"269412699303782720561143298561501283712",
"150408257788216622217213657655923676715",
"204532995104573566089020819689490136886",
"268419473899720708562328687199565742915",
"60897117315773415388666597129171362655",
"114886309097386661041113695244241628314",
"299230552727788334927226133530222746861",
"304638562440692254468448026940277588409",
"319241579192563312028246819167746494732",
"89450555842076454873903418304716044602",
"333394659869149684550520476574873626217"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff1c7e2fb9e9c3f53715fbe04d3ac47b80be7eb8",
"id": "CVE-2023-52617-a505592f",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"76568077293536928251263387727570604374",
"5249218589935536933750265607204149921",
"130104282996839860813107438965670899274",
"175476673829494595165118783467897305850",
"335910186963356402377315925260549824839",
"5679066464076109729029535223760888686",
"84095708887641616568991997721387509704",
"119584231835487084753310871838398779188",
"318777874208103608606511743712057151782",
"65444308328409026140512903930094511945",
"278657848002487287029151175658077465179",
"207151188205283749693458908771940547150",
"120117507430998728018459521879657344315",
"290276625441283421274684554820166836090",
"269412699303782720561143298561501283712",
"150408257788216622217213657655923676715",
"204532995104573566089020819689490136886",
"268419473899720708562328687199565742915",
"60897117315773415388666597129171362655",
"114886309097386661041113695244241628314",
"299230552727788334927226133530222746861",
"7752000439030186737246108155584148551",
"257959344840681508116322836658663569922",
"89450555842076454873903418304716044602",
"333394659869149684550520476574873626217"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e129c7fa7070fbce57feb0bfc5eaa65eef44b693",
"id": "CVE-2023-52617-af640ac7",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 315.0,
"function_hash": "110802628666932201378315187064408695218"
},
"signature_version": "v1",
"target": {
"function": "switchtec_pci_remove",
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0233b836312e39a3c763fb53512b3fa455b473b3",
"id": "CVE-2023-52617-b8369f93",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 1172.0,
"function_hash": "107871814067871803064493033648730379159"
},
"signature_version": "v1",
"target": {
"function": "stdev_create",
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8c293549946ee5078ed0ab77793cec365559355",
"id": "CVE-2023-52617-bff9b2ca",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 1164.0,
"function_hash": "116041555433460733386272408621373733346"
},
"signature_version": "v1",
"target": {
"function": "stdev_create",
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e129c7fa7070fbce57feb0bfc5eaa65eef44b693",
"id": "CVE-2023-52617-d201db4e",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 315.0,
"function_hash": "110802628666932201378315187064408695218"
},
"signature_version": "v1",
"target": {
"function": "switchtec_pci_remove",
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8c293549946ee5078ed0ab77793cec365559355",
"id": "CVE-2023-52617-dff37085",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 315.0,
"function_hash": "110802628666932201378315187064408695218"
},
"signature_version": "v1",
"target": {
"function": "switchtec_pci_remove",
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d83c85922647758c1f1e4806a4c5c3cf591a20a",
"id": "CVE-2023-52617-ecbfb34f",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 315.0,
"function_hash": "110802628666932201378315187064408695218"
},
"signature_version": "v1",
"target": {
"function": "switchtec_pci_remove",
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e129c7fa7070fbce57feb0bfc5eaa65eef44b693",
"id": "CVE-2023-52617-eddceef0",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 1172.0,
"function_hash": "107871814067871803064493033648730379159"
},
"signature_version": "v1",
"target": {
"function": "stdev_create",
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a5d0528cf19dbf060313dffbe047bc11c90c24c",
"id": "CVE-2023-52617-ef2407ba",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 315.0,
"function_hash": "110802628666932201378315187064408695218"
},
"signature_version": "v1",
"target": {
"function": "switchtec_pci_remove",
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a5d0528cf19dbf060313dffbe047bc11c90c24c",
"id": "CVE-2023-52617-f6335a66",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 1164.0,
"function_hash": "116041555433460733386272408621373733346"
},
"signature_version": "v1",
"target": {
"function": "stdev_create",
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0233b836312e39a3c763fb53512b3fa455b473b3",
"id": "CVE-2023-52617-f84598d3",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 355.0,
"function_hash": "110998826186471696627643621735550562184"
},
"signature_version": "v1",
"target": {
"function": "stdev_release",
"file": "drivers/pci/switch/switchtec.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0233b836312e39a3c763fb53512b3fa455b473b3",
"id": "CVE-2023-52617-f96c8fe2",
"deprecated": false
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-52617.json"