CVE-2021-47554

The system will crash if we put an uninitialized iovadomain, this could happen when an error occurs before initializing the iovadomain in vdpasim_create().

BUG: kernel NULL pointer dereference, address: 0000000000000000 ... RIP: 0010:__cpuhpstateremoveinstance+0x96/0x1c0 ... Call Trace: <TASK> putiovadomain+0x29/0x220 vdpasimfree+0xd1/0x120 [vdpasim] vdpareleasedev+0x21/0x40 [vdpa] devicerelease+0x33/0x90 kobjectrelease+0x63/0x160 vdpasimcreate+0x127/0x2a0 [vdpasim] vdpasimnetdevadd+0x7d/0xfe [vdpasimnet] vdpanlcmddevaddsetdoit+0xe1/0x1a0 [vdpa] genlfamilyrcvmsgdoit+0x112/0x140 genlrcvmsg+0xdf/0x1d0 ...

So we must make sure the iova_domain is already initialized before put it.

In addition, we may get the following warning in this case: WARNING: ... drivers/iommu/iova.c:344 iovacacheput+0x58/0x70

So we must make sure the iovacacheput() is invoked only if the iovacacheget() is already invoked. Let's fix it together.

References

Affected packages

Git /

Affected ranges

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "5.13"
            },
            {
                "fixed": "5.15.6"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "5.16-rc1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "5.16-rc2"
            }
        ]
    }
]

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-47554.json"