In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace<\/p>\n
iommufd_hwpt_replace_device() calls:<\/p>\n
\tiommufd_auto_response_faults(hwpt, old_handle);<\/p>\n
passing the *new* hwpt together with the handle of
\nthe device’s *old* domain. This should be a parameter mismatch:<\/p>\n
1. Semantically, iommufd_auto_response_faults(x, handle) scans
\n x->fault’s deliver list and response xarray for groups matching
\n “handle”. A group is queued under the hwpt that was attached at
\n fault-delivery time. old_handle is fetched *before* the domain switch,
\n so its group lives on old->fault, not on the new hwpt->fault.<\/p>\n
2. Historically, the first argument was “old”. The routine was
\n introduced by commit b7d8833677ba (“iommufd: Fault-capable hwpt
\n attach\/detach\/replace”) as __fault_domain_replace_dev() in
\n fault.c, correctly calling iommufd_auto_response_faults(old, curr).
\n Commit fb21b1568ada (“iommufd: Make attach_handle generic than
\n fault specific”) moved this into iommufd_hwpt_replace_device() in
\n device.c and swapped it to “hwpt”. This should be a refactor regression,
\n not an intentional change.<\/p>\n
Fix this by passing “old” instead.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace<\/p>\n
iommufd_hwpt_replace_device() calls:<\/p>\n
\tiommufd_auto_resp<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17474","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17474","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17474"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17474"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17474"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}