| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-26709: powerpc/iommu: Fix the missing iommu_group_put() during platform domain attach |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| powerpc/iommu: Fix the missing iommu_group_put() during platform domain attach |
| |
| The function spapr_tce_platform_iommu_attach_dev() is missing to call |
| iommu_group_put() when the domain is already set. This refcount leak |
| shows up with BUG_ON() during DLPAR remove operation as: |
| |
| KernelBug: Kernel bug in state 'None': kernel BUG at arch/powerpc/platforms/pseries/iommu.c:100! |
| Oops: Exception in kernel mode, sig: 5 [#1] |
| LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=8192 NUMA pSeries |
| <snip> |
| Hardware name: IBM,9080-HEX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_016) hv:phyp pSeries |
| NIP: c0000000000ff4d4 LR: c0000000000ff4cc CTR: 0000000000000000 |
| REGS: c0000013aed5f840 TRAP: 0700 Tainted: G I (6.8.0-rc3-autotest-g99bd3cb0d12e) |
| MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 44002402 XER: 20040000 |
| CFAR: c000000000a0d170 IRQMASK: 0 |
| ... |
| NIP iommu_reconfig_notifier+0x94/0x200 |
| LR iommu_reconfig_notifier+0x8c/0x200 |
| Call Trace: |
| iommu_reconfig_notifier+0x8c/0x200 (unreliable) |
| notifier_call_chain+0xb8/0x19c |
| blocking_notifier_call_chain+0x64/0x98 |
| of_reconfig_notify+0x44/0xdc |
| of_detach_node+0x78/0xb0 |
| ofdt_write.part.0+0x86c/0xbb8 |
| proc_reg_write+0xf4/0x150 |
| vfs_write+0xf8/0x488 |
| ksys_write+0x84/0x140 |
| system_call_exception+0x138/0x330 |
| system_call_vectored_common+0x15c/0x2ec |
| |
| The patch adds the missing iommu_group_put() call. |
| |
| The Linux kernel CVE team has assigned CVE-2024-26709 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.7 with commit a8ca9fc9134c1a43e6d4db7ff59496bbd7075def and fixed in 6.7.6 with commit c90fdea9cac9eb419fc266e75d625cb60c8f7f6c |
| Issue introduced in 6.7 with commit a8ca9fc9134c1a43e6d4db7ff59496bbd7075def and fixed in 6.8 with commit 0846dd77c8349ec92ca0079c9c71d130f34cb192 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-26709 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| arch/powerpc/kernel/iommu.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/c90fdea9cac9eb419fc266e75d625cb60c8f7f6c |
| https://git.kernel.org/stable/c/0846dd77c8349ec92ca0079c9c71d130f34cb192 |
