CVE-2024-26785

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Fix protection fault in iommufd_test_syz_conv_iova

Syzkaller reported the following bug:

general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN

KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7]

Call Trace:

lock_acquire

lock_acquire+0x1ce/0x4f0

down_read+0x93/0x4a0

iommufd_test_syz_conv_iova+0x56/0x1f0

iommufd_test_access_rw.isra.0+0x2ec/0x390

iommufd_test+0x1058/0x1e30

iommufd_fops_ioctl+0x381/0x510

vfs_ioctl

__do_sys_ioctl

__se_sys_ioctl

__x64_sys_ioctl+0x170/0x1e0

do_syscall_x64

do_syscall_64+0x71/0x140

This is because the new iommufd_access_change_ioas() sets access->ioas to

NULL during its process, so the lock might be gone in a concurrent racing

context.

Fix this by doing the same access->ioas sanity as iommufd_access_rw() and

iommufd_access_pin_pages() functions do.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References