CVE-2024-56568: iommu/arm-smmu: Defer probe of clients after smmu device bound
In the Linux kernel, the following vulnerability has been resolved:
iommu/arm-smmu: Defer probe of clients after smmu device bound
Null pointer dereference occurs due to a race between smmu driver probe and client driver probe, when ofdmaconfigure() for client is called after the iommudeviceregister() for smmu driver probe has executed but before the driverbound() for smmu driver has been called.
Following is how the race occurs:
T1:Smmu device probe T2: Client device probe
reallyprobe() armsmmudeviceprobe() iommudeviceregister() reallyprobe() platformdmaconfigure() ofdmaconfigure() ofdmaconfigureid() ofiommuconfigure() iommuprobedevice() iommuinitdevice() armsmmuprobedevice() armsmmugetbyfwnode() driverfinddevicebyfwnode() driverfinddevice() nextdevice() klistnext() / null ptr assigned to smmu / / null ptr dereference while smmu->streamidmask / driverbound() klistaddtail()
When this null smmu pointer is dereferenced later in armsmmuprobedevice, the device crashes.
Fix this by deferring the probe of the client device until the smmu device has bound to the arm smmu driver.
[will: Add comment]
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56568?
CVE-2024-56568 has a high severity due to its potential for causing null pointer dereference leading to system instability.
Which Linux kernel versions are affected by CVE-2024-56568?
CVE-2024-56568 affects Linux kernel versions between 4.9 and 5.10.231, 5.11 and 5.15.174, 5.16 and 6.1.120, 6.2 and 6.6.66, as well as 6.7 and 6.12.4.
How do I fix CVE-2024-56568?
To fix CVE-2024-56568, update your Linux kernel to a version that is not affected, ensuring you choose a version above 6.12.4.
What causes CVE-2024-56568?
CVE-2024-56568 is caused by a race condition between the SMMU driver probe and client driver probe, leading to a null pointer dereference.
Is there a workaround for CVE-2024-56568?
Currently, there are no recommended workarounds for CVE-2024-56568 other than updating to a safe kernel version.