CVE-2024-58093

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> PCI/ASPM: Fix link state exit during switch upstream function removal<br /> <br /> Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to<br /> avoid use-after-free"), we would free the ASPM link only after the last<br /> function on the bus pertaining to the given link was removed.<br /> <br /> That was too late. If function 0 is removed before sibling function,<br /> link-&gt;downstream would point to free&amp;#39;d memory after.<br /> <br /> After above change, we freed the ASPM parent link state upon any function<br /> removal on the bus pertaining to a given link.<br /> <br /> That is too early. If the link is to a PCIe switch with MFD on the upstream<br /> port, then removing functions other than 0 first would free a link which<br /> still remains parent_link to the remaining downstream ports.<br /> <br /> The resulting GPFs are especially frequent during hot-unplug, because<br /> pciehp removes devices on the link bus in reverse order.<br /> <br /> On that switch, function 0 is the virtual P2P bridge to the internal bus.<br /> Free exactly when function 0 is removed -- before the parent link is<br /> obsolete, but after all subordinate links are gone.<br /> <br /> [kwilczynski: commit log]