CVE-2023-52484
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-52484
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-52484.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2023-52484
- Downstream
- Related
- Published
- 2024-02-29T06:15:46Z
- Modified
- 2025-08-09T20:01:28Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
iommu/arm-smmu-v3: Fix soft lockup triggered by armsmmumminvalidaterange
When running an SVA case, the following soft lockup is triggered:
watchdog: BUG: soft lockup - CPU#244 stuck for 26s! pstate: 83400009 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : armsmmucmdqissuecmdlist+0x178/0xa50 lr : armsmmucmdqissuecmdlist+0x150/0xa50 sp : ffff8000d83ef290 x29: ffff8000d83ef290 x28: 000000003b9aca00 x27: 0000000000000000 x26: ffff8000d83ef3c0 x25: da86c0812194a0e8 x24: 0000000000000000 x23: 0000000000000040 x22: ffff8000d83ef340 x21: ffff0000c63980c0 x20: 0000000000000001 x19: ffff0000c6398080 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: ffff3000b4a3bbb0 x14: ffff3000b4a30888 x13: ffff3000b4a3cf60 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc08120e4d6bc x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000048cfa x5 : 0000000000000000 x4 : 0000000000000001 x3 : 000000000000000a x2 : 0000000080000000 x1 : 0000000000000000 x0 : 0000000000000001 Call trace: armsmmucmdqissuecmdlist+0x178/0xa50 _armsmmutlbinvrange+0x118/0x254 armsmmutlbinvrangeasid+0x6c/0x130 armsmmumminvalidaterange+0xa0/0xa4 _mmunotifierinvalidaterangeend+0x88/0x120 unmapvmas+0x194/0x1e0 unmapregion+0xb4/0x144 domasalignmunmap+0x290/0x490 domasmunmap+0xbc/0x124 _vmmunmap+0xa8/0x19c _arm64sysmunmap+0x28/0x50 invokesyscall+0x78/0x11c el0svccommon.constprop.0+0x58/0x1c0 doel0svc+0x34/0x60 el0svc+0x2c/0xd4 el0t64synchandler+0x114/0x140
el0t64sync+0x1a4/0x1a8
Note that since 6.6-rc1 the armsmmumminvalidaterange above is renamed to "armsmmummarchinvalidatesecondarytlbs", yet the problem remains.
The commit 06ff87bae8d3 ("arm64: mm: remove unused functions and variable protoypes") fixed a similar lockup on the CPU MMU side. Yet, it can occur to SMMU too, since armsmmummarchinvalidatesecondarytlbs() is called typically next to MMU tlb flush function, e.g. tlbflushmmutlbonly { tlbflush { _flushtlbrange { // check MAXTLBIOPS } } mmunotifierarchinvalidatesecondarytlbs { armsmmummarchinvalidatesecondarytlbs { // does not check MAXTLBIOPS } } }
Clone a CMDQMAXTLBIOPS from the MAXTLBI_OPS in tlbflush.h, since in an SVA case SMMU uses the CPU page table, so it makes sense to align with the tlbflush code. Then, replace per-page TLBI commands with a single per-asid TLBI command, if the request size hits this threshold.
- References