CVE-2024-35957

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-35957
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-35957.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-35957
Downstream
Related
Published
2024-05-20T09:41:49Z
Modified
2025-10-17T03:55:55.676421Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
iommu/vt-d: Fix WARN_ON in iommu probe path
Details

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Fix WARN_ON in iommu probe path

Commit 1a75cc710b95 ("iommu/vt-d: Use rbtree to track iommu probed devices") adds all devices probed by the iommu driver in a rbtree indexed by the source ID of each device. It assumes that each device has a unique source ID. This assumption is incorrect and the VT-d spec doesn't state this requirement either.

The reason for using a rbtree to track devices is to look up the device with PCI bus and devfunc in the paths of handling ATS invalidation time out error and the PRI I/O page faults. Both are PCI ATS feature related.

Only track the devices that have PCI ATS capabilities in the rbtree to avoid unnecessary WARN_ON in the iommu probe path. Otherwise, on some platforms below kernel splat will be displayed and the iommu probe results in failure.

WARNING: CPU: 3 PID: 166 at drivers/iommu/intel/iommu.c:158 inteliommuprobedevice+0x319/0xd90 Call Trace: <TASK> ? warn+0x7e/0x180 ? inteliommuprobedevice+0x319/0xd90 ? reportbug+0x1f8/0x200 ? handlebug+0x3c/0x70 ? excinvalidop+0x18/0x70 ? asmexcinvalidop+0x1a/0x20 ? inteliommuprobedevice+0x319/0xd90 ? debugmutexinit+0x37/0x50 _iommuprobedevice+0xf2/0x4f0 iommuprobedevice+0x22/0x70 iommubusnotifier+0x1e/0x40 notifiercallchain+0x46/0x150 blockingnotifiercallchain+0x42/0x60 busnotify+0x2f/0x50 deviceadd+0x5ed/0x7e0 platformdeviceadd+0xf5/0x240 mfdadddevices+0x3f9/0x500 ? preemptcountadd+0x4c/0xa0 ? upwrite+0xa2/0x1b0 ? _debugfscreatefile+0xe3/0x150 intellpssprobe+0x49f/0x5b0 ? pciconf1write+0xa3/0xf0 intellpsspciprobe+0xcf/0x110 [intellpsspci] pcideviceprobe+0x95/0x120 reallyprobe+0xd9/0x370 ? _pfxdriverattach+0x10/0x10 driverprobedevice+0x73/0x150 driverprobedevice+0x19/0xa0 _driverattach+0xb6/0x180 ? _pfxdriverattach+0x10/0x10 busforeachdev+0x77/0xd0 busadddriver+0x114/0x210 driverregister+0x5b/0x110 ? _pfxintellpsspcidriverinit+0x10/0x10 [intellpsspci] dooneinitcall+0x57/0x2b0 ? kmalloctrace+0x21e/0x280 ? doinitmodule+0x1e/0x210 doinitmodule+0x5f/0x210 loadmodule+0x1d37/0x1fc0 ? initmodulefromfile+0x86/0xd0 initmodulefromfile+0x86/0xd0 idempotentinitmodule+0x17c/0x230 _x64sysfinitmodule+0x56/0xb0 dosyscall64+0x6e/0x140 entrySYSCALL64afterhwframe+0x71/0x79

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c618d446f1d64bdc9e426bab5e8619f224cde2ae
Fixed
fba8ca3e6f608b92e54271fdbd3ce569361939fc
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
1a75cc710b956010137b4fe1d1fa3282bfd8f86c
Fixed
89436f4f54125b1297aec1f466efd8acb4ec613d

Affected versions

v6.*

v6.8
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.8.2
v6.8.3
v6.8.4
v6.8.5
v6.8.6
v6.9-rc1
v6.9-rc2
v6.9-rc3

Database specific

vanir_signatures

[
    {
        "signature_type": "Function",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89436f4f54125b1297aec1f466efd8acb4ec613d",
        "signature_version": "v1",
        "target": {
            "function": "intel_iommu_probe_device",
            "file": "drivers/iommu/intel/iommu.c"
        },
        "digest": {
            "function_hash": "19093669662568577016159116992921153239",
            "length": 1687.0
        },
        "id": "CVE-2024-35957-107cc939"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89436f4f54125b1297aec1f466efd8acb4ec613d",
        "signature_version": "v1",
        "target": {
            "function": "intel_iommu_release_device",
            "file": "drivers/iommu/intel/iommu.c"
        },
        "digest": {
            "function_hash": "315482591369359903372113651651222819451",
            "length": 398.0
        },
        "id": "CVE-2024-35957-1e90b60d"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fba8ca3e6f608b92e54271fdbd3ce569361939fc",
        "signature_version": "v1",
        "target": {
            "file": "drivers/iommu/intel/iommu.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "322697463084454065359186298704191911384",
                "304792288180212550939335863700980105677",
                "272968736448391292520099661777209650052",
                "307785389074338321270011282369816998251",
                "173884712409505886996073587676484621108",
                "100161126050751154867676121504926179555",
                "297223789828461972497564425189127759285",
                "278451101522525461469073438358188838384",
                "122695065143611366304836189706281760977",
                "166091329249324520675318300020731734254"
            ]
        },
        "id": "CVE-2024-35957-8c77eec1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fba8ca3e6f608b92e54271fdbd3ce569361939fc",
        "signature_version": "v1",
        "target": {
            "function": "intel_iommu_probe_device",
            "file": "drivers/iommu/intel/iommu.c"
        },
        "digest": {
            "function_hash": "253444583903567187742944736765059333273",
            "length": 1541.0
        },
        "id": "CVE-2024-35957-c80ec467"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fba8ca3e6f608b92e54271fdbd3ce569361939fc",
        "signature_version": "v1",
        "target": {
            "function": "intel_iommu_release_device",
            "file": "drivers/iommu/intel/iommu.c"
        },
        "digest": {
            "function_hash": "315482591369359903372113651651222819451",
            "length": 398.0
        },
        "id": "CVE-2024-35957-d26957b5"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89436f4f54125b1297aec1f466efd8acb4ec613d",
        "signature_version": "v1",
        "target": {
            "file": "drivers/iommu/intel/iommu.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "322697463084454065359186298704191911384",
                "304792288180212550939335863700980105677",
                "272968736448391292520099661777209650052",
                "307785389074338321270011282369816998251",
                "173884712409505886996073587676484621108",
                "100161126050751154867676121504926179555",
                "297223789828461972497564425189127759285",
                "278451101522525461469073438358188838384",
                "122695065143611366304836189706281760977",
                "166091329249324520675318300020731734254"
            ]
        },
        "id": "CVE-2024-35957-ebe24244"
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.8.2
Fixed
6.8.7