Description
In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized tegra241_vintf_init_lvcmdq() stores the freshly allocated vcmdq pointer to the vintf->lvcmdqs[] array, before tegra241_vcmdq_alloc_smmu_cmdq() builds the vcmdq->cmdq. The error ISR dereferences that cmdq, so a latched LVCMDQ error (e.g. one inherited across a kexec) firing in this window would make tegra241_vintf0_handle_error() pass the still-zeroed arm_smmu_cmdq down to __arm_smmu_cmdq_skip_err(), dereferencing NULL queue register pointers. Drop the store from tegra241_vintf_init_lvcmdq() and publish the vcmdq at the end of the allocation instead, with an smp_store_release() that pairs with an smp_load_acquire() in the ISR, which can see a fully built LVCMDQ or NULL. The user-owned LVCMDQ allocation moves accordingly, publishing the vcmdq once tegra241_vcmdq_hw_init_user() succeeds, using a plain store since a user VINTF's lvcmdqs[] has no lockless reader -- the error ISR only walks the VINTF0 array.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
918eb5c856f6ce4cf93b4b38e4b5e156905c5943 to < d5ec248ee1c79354979c23f7f390e856e9535651affected918eb5c856f6ce4cf93b4b38e4b5e156905c5943 to < 792f720fc23fe5bd6508d40ed73ae739debd6dcbaffected918eb5c856f6ce4cf93b4b38e4b5e156905c5943 to < b4535b403d6bf9bcc24dbd62096711329b9c612caffected918eb5c856f6ce4cf93b4b38e4b5e156905c5943 to < cbc41aacd49e695338940196e7084770365e1b68affected
Linux Linux
Default version status: affected
6.12affected0 to < 6.12unaffected6.12.111 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected