Jason Gunthorpe

The issue is related to the I/O page fault handler in the Linux kernel, which currently locates the PCI device by calling `pci get domain bus and slot()`. This function searches the list of all PCI devices until the desired device is found. To improve lookup efficiency, it is replaced with `device rbtree find()` to search the device within the probed device rbtree. The I/O page fault is initiated by the device, which does not have any synchronization mechanism with the software to ensure that the device stays in the probed device tree. Theoretically, a device could be released by the IOMMU subsystem after `device rbtree find()` and before `iopf get dev fault param()`, which would cause a use-after-free problem. A mutex is added to synchronize the I/O page fault reporting path and the IOMMU release device path.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to the `iommufd access change ioas()` function in the Linux kernel, which sets `access->ioas` to NULL during its process, potentially causing a lock to be gone in a concurrent racing context. This can lead to a general protection fault, probably for a non-canonical address. The problem is fixed by doing the same `access->ioas` sanity check as the `iommufd access rw()` and `iommufd access pin pages()` functions. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to an overwrite of `access->iopt access list id` in the `iopt add access()` function, which is called from `iommufd access change ioas()` when `xa alloc()` succeeds but `iopt calculate iova alignment()` fails. This results in a mismatch between the access pointer in the list and the passed-in pointer. The vulnerability can lead to a denial of service.

تم تحديد مشكلة في إشارة مؤشر فارغة في نواة Linux، وتحديدًا في مكون iommu/omap. نشأت هذه المشكلة عن تراجع ناتج عن عملية «commit» غيرت نوع عائد الدالة، لكنها لم تقم بتحويل موقع محدد، مما تسبب في أن تعيد عملية فحص iommu omap القيمة 0 بدلاً من ERR PTR(-ENODEV). تحدث المشكلة في الدالة ` iommu probe device`، التي يتم استدعاؤها بواسطة `probe iommu group`، ثم بواسطة دوال أخرى مثل `bus for each dev` و`bus iommu probe`. وقد لاحظ جيسون غونثورب هذه المشكلة، وهي مرتبطة بعمليات «كوميت» سابقة غيرت وظيفة فحص iommu/omap.

The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and OOPS, when SCTP authentication is enabled. This occurs by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction.