Bugzilla – Bug 1221930
VUL-0: CVE-2021-47140: kernel: iommu/amd: Clear DMA ops when switching domain
Last modified: 2024-04-19 09:12:57 UTC
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Clear DMA ops when switching domain Since commit 08a27c1c3ecf ("iommu: Add support to change default domain of an iommu group") a user can switch a device between IOMMU and direct DMA through sysfs. This doesn't work for AMD IOMMU at the moment because dev->dma_ops is not cleared when switching from a DMA to an identity IOMMU domain. The DMA layer thus attempts to use the dma-iommu ops on an identity domain, causing an oops: # echo 0000:00:05.0 > /sys/sys/bus/pci/drivers/e1000e/unbind # echo identity > /sys/bus/pci/devices/0000:00:05.0/iommu_group/type # echo 0000:00:05.0 > /sys/sys/bus/pci/drivers/e1000e/bind ... BUG: kernel NULL pointer dereference, address: 0000000000000028 ... Call Trace: iommu_dma_alloc e1000e_setup_tx_resources e1000e_open Since iommu_change_dev_def_domain() calls probe_finalize() again, clear the dma_ops there like Vt-d does. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-47140 https://www.cve.org/CVERecord?id=CVE-2021-47140 https://git.kernel.org/stable/c/d6177a6556f853785867e2ec6d5b7f4906f0d809 https://git.kernel.org/stable/c/f3f2cf46291a693eab21adb94171b0128c2a9ec1 https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2021/CVE-2021-47140.mbox
Offending commit (08a27c1c3ecf) found in: - ALP-current - cve/linux-5.14-LTSS - SLE15-SP4-LTSS - SLE15-SP5 - SLE15-SP6 - SLE15-SP6-GA - stable Fixing commit (f3f2cf46291a) found in: - ALP-current - cve/linux-5.14-LTSS - SLE15-SP4-LTSS - SLE15-SP5 - SLE15-SP6 - SLE15-SP6-GA - stable All branches fixed. @kernel-team, please add the CVE reference.
References added. Back to security team. d6177a6556f8 ("iommu/amd: Clear DMA ops when switching domain") merged v5.13-rc4~27^2~5 Fixes: 08a27c1c3ecf ("iommu: Add support to change default domain of an iommu group") merged v5.11-rc1~105^2~9^2~3 Security fix for CVE-2021-47140 bsc#1221930 with CVSS 5.5 ............................ EVERYTHING IS OK!