CVE-2024-56568

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-56568
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-56568.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-56568
Downstream
Related
Published
2024-12-27T15:15:15Z
Modified
2025-08-09T20:01:25Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

iommu/arm-smmu: Defer probe of clients after smmu device bound

Null pointer dereference occurs due to a race between smmu driver probe and client driver probe, when ofdmaconfigure() for client is called after the iommudeviceregister() for smmu driver probe has executed but before the driver_bound() for smmu driver has been called.

Following is how the race occurs:

T1:Smmu device probe T2: Client device probe

reallyprobe() armsmmudeviceprobe() iommudeviceregister() reallyprobe() platformdmaconfigure() ofdmaconfigure() ofdmaconfigureid() ofiommuconfigure() iommuprobedevice() iommuinitdevice() armsmmuprobedevice() armsmmugetbyfwnode() driverfinddevicebyfwnode() driverfinddevice() nextdevice() klistnext() /* null ptr assigned to smmu */ /* null ptr dereference while smmu->streamidmask */ driverbound() klistadd_tail()

When this null smmu pointer is dereferenced later in armsmmuprobe_device, the device crashes.

Fix this by deferring the probe of the client device until the smmu device has bound to the arm smmu driver.

[will: Add comment]

References

Affected packages