CVE-2022-48916

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iommu/vt-d: Fix double list_add when enabling VMD in scalable mode<br /> <br /> When enabling VMD and IOMMU scalable mode, the following kernel panic<br /> call trace/kernel log is shown in Eagle Stream platform (Sapphire Rapids<br /> CPU) during booting:<br /> <br /> pci 0000:59:00.5: Adding to iommu group 42<br /> ...<br /> vmd 0000:59:00.5: PCI host bridge to bus 10000:80<br /> pci 10000:80:01.0: [8086:352a] type 01 class 0x060400<br /> pci 10000:80:01.0: reg 0x10: [mem 0x00000000-0x0001ffff 64bit]<br /> pci 10000:80:01.0: enabling Extended Tags<br /> pci 10000:80:01.0: PME# supported from D0 D3hot D3cold<br /> pci 10000:80:01.0: DMAR: Setup RID2PASID failed<br /> pci 10000:80:01.0: Failed to add to iommu group 42: -16<br /> pci 10000:80:03.0: [8086:352b] type 01 class 0x060400<br /> pci 10000:80:03.0: reg 0x10: [mem 0x00000000-0x0001ffff 64bit]<br /> pci 10000:80:03.0: enabling Extended Tags<br /> pci 10000:80:03.0: PME# supported from D0 D3hot D3cold<br /> ------------[ cut here ]------------<br /> kernel BUG at lib/list_debug.c:29!<br /> invalid opcode: 0000 [#1] PREEMPT SMP NOPTI<br /> CPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.17.0-rc3+ #7<br /> Hardware name: Lenovo ThinkSystem SR650V3/SB27A86647, BIOS ESE101Y-1.00 01/13/2022<br /> Workqueue: events work_for_cpu_fn<br /> RIP: 0010:__list_add_valid.cold+0x26/0x3f<br /> Code: 9a 4a ab ff 4c 89 c1 48 c7 c7 40 0c d9 9e e8 b9 b1 fe ff 0f<br /> 0b 48 89 f2 4c 89 c1 48 89 fe 48 c7 c7 f0 0c d9 9e e8 a2 b1<br /> fe ff 0b 48 89 d1 4c 89 c6 4c 89 ca 48 c7 c7 98 0c d9<br /> 9e e8 8b b1 fe<br /> RSP: 0000:ff5ad434865b3a40 EFLAGS: 00010246<br /> RAX: 0000000000000058 RBX: ff4d61160b74b880 RCX: ff4d61255e1fffa8<br /> RDX: 0000000000000000 RSI: 00000000fffeffff RDI: ffffffff9fd34f20<br /> RBP: ff4d611d8e245c00 R08: 0000000000000000 R09: ff5ad434865b3888<br /> R10: ff5ad434865b3880 R11: ff4d61257fdc6fe8 R12: ff4d61160b74b8a0<br /> R13: ff4d61160b74b8a0 R14: ff4d611d8e245c10 R15: ff4d611d8001ba70<br /> FS: 0000000000000000(0000) GS:ff4d611d5ea00000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: ff4d611fa1401000 CR3: 0000000aa0210001 CR4: 0000000000771ef0<br /> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000<br /> DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400<br /> PKRU: 55555554<br /> Call Trace:<br /> <br /> intel_pasid_alloc_table+0x9c/0x1d0<br /> dmar_insert_one_dev_info+0x423/0x540<br /> ? device_to_iommu+0x12d/0x2f0<br /> intel_iommu_attach_device+0x116/0x290<br /> __iommu_attach_device+0x1a/0x90<br /> iommu_group_add_device+0x190/0x2c0<br /> __iommu_probe_device+0x13e/0x250<br /> iommu_probe_device+0x24/0x150<br /> iommu_bus_notifier+0x69/0x90<br /> blocking_notifier_call_chain+0x5a/0x80<br /> device_add+0x3db/0x7b0<br /> ? arch_memremap_can_ram_remap+0x19/0x50<br /> ? memremap+0x75/0x140<br /> pci_device_add+0x193/0x1d0<br /> pci_scan_single_device+0xb9/0xf0<br /> pci_scan_slot+0x4c/0x110<br /> pci_scan_child_bus_extend+0x3a/0x290<br /> vmd_enable_domain.constprop.0+0x63e/0x820<br /> vmd_probe+0x163/0x190<br /> local_pci_probe+0x42/0x80<br /> work_for_cpu_fn+0x13/0x20<br /> process_one_work+0x1e2/0x3b0<br /> worker_thread+0x1c4/0x3a0<br /> ? rescuer_thread+0x370/0x370<br /> kthread+0xc7/0xf0<br /> ? kthread_complete_and_exit+0x20/0x20<br /> ret_from_fork+0x1f/0x30<br /> <br /> Modules linked in:<br /> ---[ end trace 0000000000000000 ]---<br /> ...<br /> Kernel panic - not syncing: Fatal exception<br /> Kernel Offset: 0x1ca00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)<br /> ---[ end Kernel panic - not syncing: Fatal exception ]---<br /> <br /> The following &amp;#39;lspci&amp;#39; output shows devices &amp;#39;10000:80:*&amp;#39; are subdevices of<br /> the VMD device 0000:59:00.5:<br /> <br /> $ lspci<br /> ...<br /> 0000:59:00.5 RAID bus controller: Intel Corporation Volume Management Device NVMe RAID Controller (rev 20)<br /> ...<br /> 10000:80:01.0 PCI bridge: Intel Corporation Device 352a (rev 03)<br /> 10000:80:03.0 PCI bridge: Intel Corporation Device 352b (rev 03)<br /> 10000:80:05.0 PCI bridge: Intel Corporation Device 352c (rev 03)<br /> 10000:80:07.0 PCI bridge: Intel Corporation Device 352d (rev 03)<br /> 10000:81:00.0 Non-Volatile memory controller: Intel Corporation NVMe Datacenter SSD [3DNAND, Beta Rock Controller]<br /> 10000:82:00<br /> ---truncated---