CVE-2021-47140

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Clear DMA ops when switching domain

Since commit 08a27c1c3ecf ("iommu: Add support to change default domain

of an iommu group") a user can switch a device between IOMMU and direct

DMA through sysfs. This doesn't work for AMD IOMMU at the moment because

dev->dma_ops is not cleared when switching from a DMA to an identity

IOMMU domain. The DMA layer thus attempts to use the dma-iommu ops on an

identity domain, causing an oops:

# echo 0000:00:05.0 > /sys/sys/bus/pci/drivers/e1000e/unbind

# echo identity > /sys/bus/pci/devices/0000:00:05.0/iommu_group/type

# echo 0000:00:05.0 > /sys/sys/bus/pci/drivers/e1000e/bind

...

BUG: kernel NULL pointer dereference, address: 0000000000000028

...

Call Trace:

iommu_dma_alloc

e1000e_setup_tx_resources

e1000e_open

Since iommu_change_dev_def_domain() calls probe_finalize() again, clear

the dma_ops there like Vt-d does.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References