CVE-2024-36925

swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y

published May 30, 2024

CVSS
—
EPSS
0%
Percentile
12.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y

Using restricted DMA pools (CONFIG_DMA_RESTRICTED_POOL=y) in conjunction

with dynamic SWIOTLB (CONFIG_SWIOTLB_DYNAMIC=y) leads to the following

crash when initialising the restricted pools at boot-time:

| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008

| Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP

| pc : rmem_swiotlb_device_init+0xfc/0x1ec

| lr : rmem_swiotlb_device_init+0xf0/0x1ec

| Call trace:

| rmem_swiotlb_device_init+0xfc/0x1ec

| of_reserved_mem_device_init_by_idx+0x18c/0x238

| of_dma_configure_id+0x31c/0x33c

| platform_dma_configure+0x34/0x80

faddr2line reveals that the crash is in the list validation code:

include/linux/list.h:83

include/linux/rculist.h:79

include/linux/rculist.h:106

kernel/dma/swiotlb.c:306

kernel/dma/swiotlb.c:1695

because add_mem_pool() is trying to list_add_rcu() to a NULL

'mem->pools'.

Fix the crash by initialising the 'mem->pools' list_head in

rmem_swiotlb_device_init() before calling add_mem_pool().

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00227 · 12.7th percentile
Published
2024-05-30T15:29Z
EPSS history
Timeline
  • 30 MAY 15:29Z
    swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y
    cvelistv5