In the Linux kernel, the following vulnerability has been resolved:
iommu/arm-smmu-v3: Fix soft lockup triggered by armsmmumminvalidaterange
watchdog: BUG: soft lockup - CPU#244 stuck for 26s! pstate: 83400009 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : armsmmucmdqissuecmdlist+0x178/0xa50 lr : armsmmucmdqissuecmdlist+0x150/0xa50 sp : ffff8000d83ef290 x29: ffff8000d83ef290 x28: 000000003b9aca00 x27: 0000000000000000 x26: ffff8000d83ef3c0 x25: da86c0812194a0e8 x24: 0000000000000000 x23: 0000000000000040 x22: ffff8000d83ef340 x21: ffff0000c63980c0 x20: 0000000000000001 x19: ffff0000c6398080 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: ffff3000b4a3bbb0 x14: ffff3000b4a30888 x13: ffff3000b4a3cf60 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc08120e4d6bc x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000048cfa x5 : 0000000000000000 x4 : 0000000000000001 x3 : 000000000000000a x2 : 0000000080000000 x1 : 0000000000000000 x0 : 0000000000000001 Call trace: armsmmucmdqissuecmdlist+0x178/0xa50 _armsmmutlbinvrange+0x118/0x254 armsmmutlbinvrangeasid+0x6c/0x130 armsmmumminvalidaterange+0xa0/0xa4 _mmunotifierinvalidaterangeend+0x88/0x120 unmapvmas+0x194/0x1e0 unmapregion+0xb4/0x144 domasalignmunmap+0x290/0x490 domasmunmap+0xbc/0x124 _vmmunmap+0xa8/0x19c _arm64sysmunmap+0x28/0x50 invokesyscall+0x78/0x11c el0svccommon.constprop.0+0x58/0x1c0 doel0svc+0x34/0x60 el0svc+0x2c/0xd4 el0t64synchandler+0x114/0x140
Note that since 6.6-rc1 the armsmmumminvalidaterange above is renamed to "armsmmummarchinvalidatesecondarytlbs", yet the problem remains.
The commit 06ff87bae8d3 ("arm64: mm: remove unused functions and variable protoypes") fixed a similar lockup on the CPU MMU side. Yet, it can occur to SMMU too, since armsmmummarchinvalidatesecondarytlbs() is called typically next to MMU tlb flush function, e.g. tlbflushmmutlbonly { tlbflush { _flushtlbrange { // check MAXTLBIOPS } } mmunotifierarchinvalidatesecondarytlbs { armsmmummarchinvalidatesecondarytlbs { // does not check MAXTLBIOPS } } }
Clone a CMDQMAXTLBIOPS from the MAXTLBI_OPS in tlbflush.h, since in an SVA case SMMU uses the CPU page table, so it makes sense to align with the tlbflush code. Then, replace per-page TLBI commands with a single per-asid TLBI command, if the request size hits this threshold.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5afb4b47e13161b3f33904d45110f9e6463bad6",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2023-52484-21f1299b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"109360388387435293837572971757493661053",
"197907047162148135341135417099059025484",
"306708243681778608829450118506973397537",
"225056059000832846865042755875828574850",
"70680185276815638577908518825365425531",
"230649941365894986339108349865686916529",
"54486461096749573559970447276386249462",
"118961531203573471865761447319429866601"
]
},
"signature_version": "v1",
"target": {
"file": "drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f90f4c562003ac3d3b135c5a40a5383313f27264",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2023-52484-496c68fb",
"digest": {
"threshold": 0.9,
"line_hashes": [
"173195024225912546070924232055719134063",
"99556966066434639895097762060486198859",
"181048169630453211790731504855098393814",
"94872298667769595533078976928907735185",
"109862998479752855056923051971935107680",
"188346841479955735318620725708391370301",
"273888997856215674989493307204191055720",
"155029115539925688033084955450946517099",
"244800964078595671450528027428351746896",
"53740410124761757169861414796008842500"
]
},
"signature_version": "v1",
"target": {
"file": "drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f90f4c562003ac3d3b135c5a40a5383313f27264",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2023-52484-57498b60",
"digest": {
"function_hash": "59940101477754605168850678378793079787",
"length": 384.0
},
"signature_version": "v1",
"target": {
"function": "arm_smmu_mm_invalidate_range",
"file": "drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3283a1bce9bbc978059f790b84f3c10c32492429",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2023-52484-5a75c219",
"digest": {
"function_hash": "59940101477754605168850678378793079787",
"length": 384.0
},
"signature_version": "v1",
"target": {
"function": "arm_smmu_mm_invalidate_range",
"file": "drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5afb4b47e13161b3f33904d45110f9e6463bad6",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2023-52484-64304978",
"digest": {
"function_hash": "129855348953802533923836234089932794976",
"length": 487.0
},
"signature_version": "v1",
"target": {
"function": "arm_smmu_mm_arch_invalidate_secondary_tlbs",
"file": "drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3283a1bce9bbc978059f790b84f3c10c32492429",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2023-52484-78d4fcfa",
"digest": {
"threshold": 0.9,
"line_hashes": [
"173195024225912546070924232055719134063",
"99556966066434639895097762060486198859",
"181048169630453211790731504855098393814",
"94872298667769595533078976928907735185",
"109862998479752855056923051971935107680",
"188346841479955735318620725708391370301",
"273888997856215674989493307204191055720",
"155029115539925688033084955450946517099",
"244800964078595671450528027428351746896",
"53740410124761757169861414796008842500"
]
},
"signature_version": "v1",
"target": {
"file": "drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5a604757aa8e37ea9c7011dc9da54fa1b30f29b",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2023-52484-a16a2dea",
"digest": {
"threshold": 0.9,
"line_hashes": [
"173195024225912546070924232055719134063",
"99556966066434639895097762060486198859",
"181048169630453211790731504855098393814",
"94872298667769595533078976928907735185",
"109862998479752855056923051971935107680",
"188346841479955735318620725708391370301",
"273888997856215674989493307204191055720",
"155029115539925688033084955450946517099",
"244800964078595671450528027428351746896",
"53740410124761757169861414796008842500"
]
},
"signature_version": "v1",
"target": {
"file": "drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5a604757aa8e37ea9c7011dc9da54fa1b30f29b",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2023-52484-c4cf6c1e",
"digest": {
"function_hash": "59940101477754605168850678378793079787",
"length": 384.0
},
"signature_version": "v1",
"target": {
"function": "arm_smmu_mm_invalidate_range",
"file": "drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c"
}
}
]