CVE-2024-56568

In the Linux kernel, the following vulnerability has been resolved:

iommu/arm-smmu: Defer probe of clients after smmu device bound

Null pointer dereference occurs due to a race between smmu driver probe and client driver probe, when ofdmaconfigure() for client is called after the iommudeviceregister() for smmu driver probe has executed but before the driver_bound() for smmu driver has been called.

Following is how the race occurs:

T1:Smmu device probe T2: Client device probe

reallyprobe() armsmmudeviceprobe() iommudeviceregister() reallyprobe() platformdmaconfigure() ofdmaconfigure() ofdmaconfigureid() ofiommuconfigure() iommuprobedevice() iommuinitdevice() armsmmuprobedevice() armsmmugetbyfwnode() driverfinddevicebyfwnode() driverfinddevice() nextdevice() klistnext() /* null ptr assigned to smmu / / null ptr dereference while smmu->streamidmask */ driverbound() klistadd_tail()

When this null smmu pointer is dereferenced later in armsmmuprobe_device, the device crashes.

Fix this by deferring the probe of the client device until the smmu device has bound to the arm smmu driver.

[will: Add comment]