CVE-2024-36926

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE<br /> <br /> At the time of LPAR boot up, partition firmware provides Open Firmware<br /> property ibm,dma-window for the PE. This property is provided on the PCI<br /> bus the PE is attached to.<br /> <br /> There are execptions where the partition firmware might not provide this<br /> property for the PE at the time of LPAR boot up. One of the scenario is<br /> where the firmware has frozen the PE due to some error condition. This<br /> PE is frozen for 24 hours or unless the whole system is reinitialized.<br /> <br /> Within this time frame, if the LPAR is booted, the frozen PE will be<br /> presented to the LPAR but ibm,dma-window property could be missing.<br /> <br /> Today, under these circumstances, the LPAR oopses with NULL pointer<br /> dereference, when configuring the PCI bus the PE is attached to.<br /> <br /> BUG: Kernel NULL pointer dereference on read at 0x000000c8<br /> Faulting instruction address: 0xc0000000001024c0<br /> Oops: Kernel access of bad area, sig: 7 [#1]<br /> LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries<br /> Modules linked in:<br /> Supported: Yes<br /> CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.4.0-150600.9-default #1<br /> Hardware name: IBM,9043-MRX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_023) hv:phyp pSeries<br /> NIP: c0000000001024c0 LR: c0000000001024b0 CTR: c000000000102450<br /> REGS: c0000000037db5c0 TRAP: 0300 Not tainted (6.4.0-150600.9-default)<br /> MSR: 8000000002009033 CR: 28000822 XER: 00000000<br /> CFAR: c00000000010254c DAR: 00000000000000c8 DSISR: 00080000 IRQMASK: 0<br /> ...<br /> NIP [c0000000001024c0] pci_dma_bus_setup_pSeriesLP+0x70/0x2a0<br /> LR [c0000000001024b0] pci_dma_bus_setup_pSeriesLP+0x60/0x2a0<br /> Call Trace:<br /> pci_dma_bus_setup_pSeriesLP+0x60/0x2a0 (unreliable)<br /> pcibios_setup_bus_self+0x1c0/0x370<br /> __of_scan_bus+0x2f8/0x330<br /> pcibios_scan_phb+0x280/0x3d0<br /> pcibios_init+0x88/0x12c<br /> do_one_initcall+0x60/0x320<br /> kernel_init_freeable+0x344/0x3e4<br /> kernel_init+0x34/0x1d0<br /> ret_from_kernel_user_thread+0x14/0x1c