CVE-2021-47554

vdpa_sim: avoid putting an uninitialized iova_domain

published May 24, 2024

CVSS
—
EPSS
0%
Percentile
8.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

vdpa_sim: avoid putting an uninitialized iova_domain

The system will crash if we put an uninitialized iova_domain, this

could happen when an error occurs before initializing the iova_domain

in vdpasim_create().

BUG: kernel NULL pointer dereference, address: 0000000000000000

...

RIP: 0010:__cpuhp_state_remove_instance+0x96/0x1c0

...

Call Trace:

<TASK>

put_iova_domain+0x29/0x220

vdpasim_free+0xd1/0x120 [vdpa_sim]

vdpa_release_dev+0x21/0x40 [vdpa]

device_release+0x33/0x90

kobject_release+0x63/0x160

vdpasim_create+0x127/0x2a0 [vdpa_sim]

vdpasim_net_dev_add+0x7d/0xfe [vdpa_sim_net]

vdpa_nl_cmd_dev_add_set_doit+0xe1/0x1a0 [vdpa]

genl_family_rcv_msg_doit+0x112/0x140

genl_rcv_msg+0xdf/0x1d0

...

So we must make sure the iova_domain is already initialized before

put it.

In addition, we may get the following warning in this case:

WARNING: ... drivers/iommu/iova.c:344 iova_cache_put+0x58/0x70

So we must make sure the iova_cache_put() is invoked only if the

iova_cache_get() is already invoked. Let's fix it together.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00193 · 8.5th percentile
Published
2024-05-24T15:09Z
EPSS history
Timeline
  • 24 MAY 15:09Z
    vdpa_sim: avoid putting an uninitialized iova_domain
    cvelistv5