In the Linux kernel, the following vulnerability has been resolved:
platform/x86/intel/pmc: Fix pmccoreiounmap to call iounmap for valid addresses
Commit 50c6dbdfd16e ("x86/ioremap: Improve iounmap() address range checks") introduces a WARN when adrress ranges of iounmap are invalid. On Thinkpad P1 Gen 7 (Meteor Lake-P) this caused the following warning to appear:
WARNING: CPU: 7 PID: 713 at arch/x86/mm/ioremap.c:461 iounmap+0x58/0x1f0 Modules linked in: rfkill(+) sndtimer(+) fjes(+) snd soundcore intelpmccore(+) int3403thermal(+) int340xthermalzone intelvsec pmttelemetry acpipad pmtclass acpitad int3400thermal acpithermalrel joydev loop nfnetlink zram xe drmsuballochelper nouveau i915 mxmwmi drmttmhelper gpusched drmgpuvm drmexec drmbuddy i2calgobit crct10difpclmul crc32pclmul ttm crc32cintel polyvalclmulni rtsxpcisdmmc ucsiacpi polyvalgeneric mmccore hidmultitouch drmdisplayhelper ghashclmulniintel typecucsi nvme sha512ssse3 video sha256ssse3 nvmecore intelvpu sha1ssse3 rtsxpci cec typec nvmeauth i2chidacpi i2chid wmi pinctrlmeteorlake serioraw ip6tables iptables fuse CPU: 7 UID: 0 PID: 713 Comm: (udev-worker) Not tainted 6.12.0-rc2iounmap+ #42 Hardware name: LENOVO 21KWCTO1WW/21KWCTO1WW, BIOS N48ET19W (1.06 ) 07/18/2024 RIP: 0010:iounmap+0x58/0x1f0 Code: 85 6a 01 00 00 48 8b 05 e6 e2 28 04 48 39 c5 72 19 eb 26 cc cc cc 48 ba 00 00 00 00 00 00 32 00 48 8d 44 02 ff 48 39 c5 72 23 <0f> 0b 48 83 c4 08 5b 5d 41 5c c3 cc cc cc cc 48 ba 00 00 00 00 00 RSP: 0018:ffff888131eff038 EFLAGS: 00010207 RAX: ffffc90000000000 RBX: 0000000000000000 RCX: ffff888e33b80000 RDX: dffffc0000000000 RSI: ffff888e33bc29c0 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff8881598a8000 R09: ffff888e2ccedc10 R10: 0000000000000003 R11: ffffffffb3367634 R12: 00000000fe000000 R13: ffff888101d0da28 R14: ffffffffc2e437e0 R15: ffff888110b03b28 FS: 00007f3c1d4b3980(0000) GS:ffff888e33b80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005651cfc93578 CR3: 0000000124e4c002 CR4: 0000000000f70ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? warn.cold+0xb6/0x176 ? iounmap+0x58/0x1f0 ? reportbug+0x1f4/0x2b0 ? handlebug+0x58/0x90 ? excinvalidop+0x17/0x40 ? asmexcinvalidop+0x1a/0x20 ? iounmap+0x58/0x1f0 pmccoressramgetpmc+0x477/0x6c0 [intelpmccore] ? _pfxpmccoressramgetpmc+0x10/0x10 [intelpmccore] ? _pfxdopcienabledevice+0x10/0x10 ? pciwaitforpending+0x60/0x110 ? pcienabledeviceflags+0x1e3/0x2e0 ? _pfxmtlcoreinit+0x10/0x10 [intelpmccore] pmccoressraminit+0x7f/0x110 [intelpmccore] mtlcoreinit+0xda/0x130 [intelpmccore] ? _mutexinit+0xb9/0x130 pmccoreprobe+0x27e/0x10b0 [intelpmccore] ? _rawspinlockirqsave+0x96/0xf0 ? _pfxpmccoreprobe+0x10/0x10 [intelpmccore] ? _pfxmutexunlock+0x10/0x10 ? _pfxmutexlock+0x10/0x10 ? devicepmcheckcallbacks+0x82/0x370 ? acpidevpmattach+0x234/0x2b0 platformprobe+0x9f/0x150 reallyprobe+0x1e0/0x8a0 _driverprobedevice+0x18c/0x370 ? _pfxdriverattach+0x10/0x10 driverprobedevice+0x4a/0x120 driverattach+0x190/0x4a0 ? _pfxdriverattach+0x10/0x10 busforeachdev+0x103/0x180 ? _pfxbusforeachdev+0x10/0x10 ? klistaddtail+0x136/0x270 busadddriver+0x2fc/0x540 driverregister+0x1a5/0x360 ? _pfxpmccoredriverinit+0x10/0x10 [intelpmccore] dooneinitcall+0xa4/0x380 ? _pfxdooneinitcall+0x10/0x10 ? kasanunpoison+0x44/0x70 doinitmodule+0x296/0x800 loadmodule+0x5090/0x6ce0 ? _pfxloadmodule+0x10/0x10 ? imapostreadfile+0x193/0x200 ? _pfximapostreadfile+0x10/0x10 ? rwverifyarea+0x152/0x4c0 ? kernelreadfile+0x257/0x750 ? _pfxkernelreadfile+0x10/0x10 ? _pfxfilemapgetreadbatch+0x10/0x10 ? initmodulefromfile+0xd1/0x130 initmodulefromfile+0xd1/0x130 ? _pfxinitmodulefrom_file+0x10/0 ---truncated---