In the Linux kernel, the following vulnerability has been resolved:
iommu/arm-smmu-v3: Fix soft lockup triggered by armsmmumminvalidaterange
watchdog: BUG: soft lockup - CPU#244 stuck for 26s! pstate: 83400009 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : armsmmucmdqissuecmdlist+0x178/0xa50 lr : armsmmucmdqissuecmdlist+0x150/0xa50 sp : ffff8000d83ef290 x29: ffff8000d83ef290 x28: 000000003b9aca00 x27: 0000000000000000 x26: ffff8000d83ef3c0 x25: da86c0812194a0e8 x24: 0000000000000000 x23: 0000000000000040 x22: ffff8000d83ef340 x21: ffff0000c63980c0 x20: 0000000000000001 x19: ffff0000c6398080 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: ffff3000b4a3bbb0 x14: ffff3000b4a30888 x13: ffff3000b4a3cf60 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc08120e4d6bc x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000048cfa x5 : 0000000000000000 x4 : 0000000000000001 x3 : 000000000000000a x2 : 0000000080000000 x1 : 0000000000000000 x0 : 0000000000000001 Call trace: armsmmucmdqissuecmdlist+0x178/0xa50 _armsmmutlbinvrange+0x118/0x254 armsmmutlbinvrangeasid+0x6c/0x130 armsmmumminvalidaterange+0xa0/0xa4 _mmunotifierinvalidaterangeend+0x88/0x120 unmapvmas+0x194/0x1e0 unmapregion+0xb4/0x144 domasalignmunmap+0x290/0x490 domasmunmap+0xbc/0x124 _vmmunmap+0xa8/0x19c _arm64sysmunmap+0x28/0x50 invokesyscall+0x78/0x11c el0svccommon.constprop.0+0x58/0x1c0 doel0svc+0x34/0x60 el0svc+0x2c/0xd4 el0t64synchandler+0x114/0x140
Note that since 6.6-rc1 the armsmmumminvalidaterange above is renamed to "armsmmummarchinvalidatesecondarytlbs", yet the problem remains.
The commit 06ff87bae8d3 ("arm64: mm: remove unused functions and variable protoypes") fixed a similar lockup on the CPU MMU side. Yet, it can occur to SMMU too, since armsmmummarchinvalidatesecondarytlbs() is called typically next to MMU tlb flush function, e.g. tlbflushmmutlbonly { tlbflush { _flushtlbrange { // check MAXTLBIOPS } } mmunotifierarchinvalidatesecondarytlbs { armsmmummarchinvalidatesecondarytlbs { // does not check MAXTLBIOPS } } }
Clone a CMDQMAXTLBIOPS from the MAXTLBI_OPS in tlbflush.h, since in an SVA case SMMU uses the CPU page table, so it makes sense to align with the tlbflush code. Then, replace per-page TLBI commands with a single per-asid TLBI command, if the request size hits this threshold.
{ "vanir_signatures": [ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5afb4b47e13161b3f33904d45110f9e6463bad6", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "109360388387435293837572971757493661053", "197907047162148135341135417099059025484", "306708243681778608829450118506973397537", "225056059000832846865042755875828574850", "70680185276815638577908518825365425531", "230649941365894986339108349865686916529", "54486461096749573559970447276386249462", "118961531203573471865761447319429866601" ] }, "id": "CVE-2023-52484-21f1299b", "target": { "file": "drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f90f4c562003ac3d3b135c5a40a5383313f27264", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "173195024225912546070924232055719134063", "99556966066434639895097762060486198859", "181048169630453211790731504855098393814", "94872298667769595533078976928907735185", "109862998479752855056923051971935107680", "188346841479955735318620725708391370301", "273888997856215674989493307204191055720", "155029115539925688033084955450946517099", "244800964078595671450528027428351746896", "53740410124761757169861414796008842500" ] }, "id": "CVE-2023-52484-496c68fb", "target": { "file": "drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f90f4c562003ac3d3b135c5a40a5383313f27264", "signature_type": "Function", "digest": { "function_hash": "59940101477754605168850678378793079787", "length": 384.0 }, "id": "CVE-2023-52484-57498b60", "target": { "file": "drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c", "function": "arm_smmu_mm_invalidate_range" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3283a1bce9bbc978059f790b84f3c10c32492429", "signature_type": "Function", "digest": { "function_hash": "59940101477754605168850678378793079787", "length": 384.0 }, "id": "CVE-2023-52484-5a75c219", "target": { "file": "drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c", "function": "arm_smmu_mm_invalidate_range" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5afb4b47e13161b3f33904d45110f9e6463bad6", "signature_type": "Function", "digest": { "function_hash": "129855348953802533923836234089932794976", "length": 487.0 }, "id": "CVE-2023-52484-64304978", "target": { "file": "drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c", "function": "arm_smmu_mm_arch_invalidate_secondary_tlbs" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3283a1bce9bbc978059f790b84f3c10c32492429", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "173195024225912546070924232055719134063", "99556966066434639895097762060486198859", "181048169630453211790731504855098393814", "94872298667769595533078976928907735185", "109862998479752855056923051971935107680", "188346841479955735318620725708391370301", "273888997856215674989493307204191055720", "155029115539925688033084955450946517099", "244800964078595671450528027428351746896", "53740410124761757169861414796008842500" ] }, "id": "CVE-2023-52484-78d4fcfa", "target": { "file": "drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5a604757aa8e37ea9c7011dc9da54fa1b30f29b", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "173195024225912546070924232055719134063", "99556966066434639895097762060486198859", "181048169630453211790731504855098393814", "94872298667769595533078976928907735185", "109862998479752855056923051971935107680", "188346841479955735318620725708391370301", "273888997856215674989493307204191055720", "155029115539925688033084955450946517099", "244800964078595671450528027428351746896", "53740410124761757169861414796008842500" ] }, "id": "CVE-2023-52484-a16a2dea", "target": { "file": "drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5a604757aa8e37ea9c7011dc9da54fa1b30f29b", "signature_type": "Function", "digest": { "function_hash": "59940101477754605168850678378793079787", "length": 384.0 }, "id": "CVE-2023-52484-c4cf6c1e", "target": { "file": "drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c", "function": "arm_smmu_mm_invalidate_range" }, "deprecated": false, "signature_version": "v1" } ] }