From: =?UTF-8?q?Krzysztof=20Wilczy=C5=84ski?= <kw@linux.com>

Date: Thu, 29 Jul 2021 23:37:54 +0000

Subject: PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Git-commit: a8bd29bd49c4156ea0ec5a97812333e2aeef44e7

Patch-mainline: 5.15-rc1

References: git-fixes

The pciconfig_read() syscall reads PCI configuration space using

hardware-dependent config accessors.

If the read fails on PCI, most accessors don't return an error; they

pretend the read was successful and got ~0 data from the device, so the

syscall returns success with ~0 data in the buffer.

When the accessor does return an error, pciconfig_read() normally fills the

user's buffer with ~0 and returns an error in errno.  But after

e4585da22ad0 ("pci syscall.c: Switch to refcounting API"), we don't fill

the buffer with ~0 for the EPERM "user lacks CAP_SYS_ADMIN" error.

Userspace may rely on the ~0 data to detect errors, but after e4585da22ad0,

that would not detect CAP_SYS_ADMIN errors.

Restore the original behaviour of filling the buffer with ~0 when the

CAP_SYS_ADMIN check fails.

[bhelgaas: commit log, fold in Nathan's fix

https://lore.kernel.org/r/20210803200836.500658-1-nathan@kernel.org]

Fixes: e4585da22ad0 ("pci syscall.c: Switch to refcounting API")

Link: https://lore.kernel.org/r/20210729233755.1509616-1-kw@linux.com

Signed-off-by: Krzysztof Wilczyński <kw@linux.com>

Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>

Cc: stable@vger.kernel.org

Signed-off-by: Jiri Slaby <jslaby@suse.cz>

---

 drivers/pci/syscall.c |    4 +++-

 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/pci/syscall.c

+++ b/drivers/pci/syscall.c

@@ -23,8 +23,10 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned

 	long err;

 	int cfg_ret;

+	err = -EPERM;

+	dev = NULL;

 	if (!capable(CAP_SYS_ADMIN))

-		return -EPERM;

+		goto error;

 	err = -ENODEV;

 	dev = pci_get_bus_and_slot(bus, dfn);