In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
iommu\/vt-d: Tear down scalable-mode context on probe failure<\/p>\n
intel_pasid_setup_sm_context() walks a PCI device\u2019s DMA aliases via
\npci_for_each_dma_alias() and programs a scalable-mode context entry for
\neach RID. For a device with a dma_alias_mask, the callback is invoked
\nonce for the device\u2019s own RID and once for each alias bit, all with the
\nsame pci_dev, so device_pasid_table_setup() runs for multiple RIDs.<\/p>\n
pci_for_each_dma_alias() stops at the first callback error. Therefore, a
\nfailure partway through the walk can leave context entries for already
\nprocessed RIDs present and still pointing to the device\u2019s PASID table.<\/p>\n
On this error path, intel_iommu_probe_device() currently jumps directly
\nto intel_pasid_free_table(), which frees the PASID table without
\nfirst tearing down those context entries. The IOMMU may then walk a
\npresent context entry whose PASID table pointer references freed
\nmemory.<\/p>\n
intel_iommu_release_device() already performs teardown before freeing the
\ntable. Apply the same ordering on the probe failure path.<\/p>\n
device_pasid_table_teardown() safely handles RIDs that were never
\nprogrammed: iommu_context_addr() returns NULL when no context table has
\nbeen allocated, and clearing the Present bit of an already non-present
\nentry is a no-op. So unwind is safe for both the alias that failed and
\nany aliases not yet reached.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
iommu\/vt-d: Tear down scalable-mode context on probe failure<\/p>\n
intel_pasid_setup_sm_context() walks a PCI device\u2019s DMA aliases via
\np<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25650","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25650","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25650"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25650"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25650"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}