CVE-2024-57999: powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW
In the Linux kernel, the following vulnerability has been resolved:
powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW
Power Hypervisor can possibily allocate MMIO window intersecting with Dynamic DMA Window (DDW) range, which is over 32-bit addressing.
These MMIO pages needs to be marked as reserved so that IOMMU doesn't map DMA buffers in this range.
The current code is not marking these pages correctly which is resulting in LPAR to OOPS while booting. The stack is at below
BUG: Unable to handle kernel data access on read at 0xc00800005cd40000 Faulting instruction address: 0xc00000000005cdac Oops: Kernel access of bad area, sig: 11 [#1] LE PAGESIZE=64K MMU=Hash SMP NRCPUS=2048 NUMA pSeries Modules linked in: afpacket rfkill ibmveth(X) lpfc(+) nvmetfc nvmet nvmekeyring crct10difvpmsum nvmefc nvmefabrics nvmecore be2net(+) nvmeauth rtcgeneric nfsd authrpcgss nfsacl lockd grace sunrpc fuse configfs iptables xtables xfs libcrc32c dmservicetime ibmvfc(X) scsitransportfc vmxcrypto gf128mul crc32cvpmsum dmmirror dmregionhash dmlog dmmultipath dmmod sdmod scsidhemc scsidhrdac scsidhalua t10pi crc64rocksoftgeneric crc64rocksoft sg crc64 scsimod Supported: Yes, External CPU: 8 PID: 241 Comm: kworker/8:1 Kdump: loaded Not tainted 6.4.0-150600.23.14-default #1 SLE15-SP6 b44ee71c81261b9e4bab5e0cde1f2ed891d5359b Hardware name: IBM,9080-M9S POWER9 (raw) 0x4e2103 0xf000005 of:IBM,FW950.B0 (VH950149) hv:phyp pSeries Workqueue: events workforcpufn NIP: c00000000005cdac LR: c00000000005e830 CTR: 0000000000000000 REGS: c00001400c9ff770 TRAP: 0300 Not tainted (6.4.0-150600.23.14-default) MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 24228448 XER: 00000001 CFAR: c00000000005cdd4 DAR: c00800005cd40000 DSISR: 40000000 IRQMASK: 0 GPR00: c00000000005e830 c00001400c9ffa10 c000000001987d00 c00001400c4fe800 GPR04: 0000080000000000 0000000000000001 0000000004000000 0000000000800000 GPR08: 0000000004000000 0000000000000001 c00800005cd40000 ffffffffffffffff GPR12: 0000000084228882 c00000000a4c4f00 0000000000000010 0000080000000000 GPR16: c00001400c4fe800 0000000004000000 0800000000000000 c00000006088b800 GPR20: c00001401a7be980 c00001400eff3800 c000000002a2da68 000000000000002b GPR24: c0000000026793a8 c000000002679368 000000000000002a c0000000026793c8 GPR28: 000008007effffff 0000080000000000 0000000000800000 c00001400c4fe800 NIP [c00000000005cdac] iommutablereservepages+0xac/0x100 LR [c00000000005e830] iommuinittable+0x80/0x1e0 Call Trace: [c00001400c9ffa10] [c00000000005e810] iommuinittable+0x60/0x1e0 (unreliable) [c00001400c9ffa90] [c00000000010356c] iommubypasssupportedpSeriesLP+0x9cc/0xe40 [c00001400c9ffc30] [c00000000005c300] dmaiommudmasupported+0xf0/0x230 [c00001400c9ffcb0] [c00000000024b0c4] dmasupported+0x44/0x90 [c00001400c9ffcd0] [c00000000024b14c] dmasetmask+0x3c/0x80 [c00001400c9ffd00] [c0080000555b715c] beprobe+0xc4/0xb90 [be2net] [c00001400c9ffdc0] [c000000000986f3c] localpciprobe+0x6c/0x110 [c00001400c9ffe40] [c000000000188f28] workforcpufn+0x38/0x60 [c00001400c9ffe70] [c00000000018e454] processonework+0x314/0x620 [c00001400c9fff10] [c00000000018f280] workerthread+0x2b0/0x620 [c00001400c9fff90] [c00000000019bb18] kthread+0x148/0x150 [c00001400c9fffe0] [c00000000000ded8] startkernelthread+0x14/0x18
There are 2 issues in the code
1. The index is "int" while the address is "unsigned long". This results in negative value when setting the bitmap.
2. The DMA offset is page shifted but the MMIO range is used as-is (64-bit address). MMIO address needs to be page shifted as well.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (powerpc/pseries/iommu)to a version that resolves this vulnerability.Fixed in 6.4.0-150600.23.14-defaultPatch LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries - Configuration
Update the powerpc/pseries IOMMU logic so that the MMIO pages intersecting the Dynamic DMA Window are marked as reserved; this prevents incorrect mapping that leads to kernel access of an invalid address range.
powerpc/pseries iommu (IOMMU DDW/MMIO mapping) MMIO range reservation/marking for pages intersecting Dynamic DMA Window (DDW) = mark MMIO pages as reserved so the IOMMU doesn't map them - Configuration
Fix MMIO page-shift handling by page-shifting the MMIO address as well, and correct the bitmap/index handling where the index is currently an “int” but the address is an “unsigned long”, causing negative bitmap values.
powerpc/pseries iommu (MMIO page-shift handling) MMIO address page shifting and bitmap index type = page shift MMIO address and use an index type that avoids int overflow (index is “int” while address is “unsigned long”)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-57999?
CVE-2024-57999 has not been rated for severity but it involves a potential allocation conflict in the Power Hypervisor.
How do I fix CVE-2024-57999?
To fix CVE-2024-57999, update to the latest version of the Linux kernel where this vulnerability has been resolved.
What causes CVE-2024-57999?
CVE-2024-57999 is caused by the Power Hypervisor incorrectly marking the MMIO range, leading to possible allocation issues.
Which versions of the Linux kernel are affected by CVE-2024-57999?
CVE-2024-57999 affects certain versions of the Linux kernel used with Power Hypervisor.
What are the potential impacts of CVE-2024-57999?
The potential impacts of CVE-2024-57999 include system instability and conflicts in memory mapping.