https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 13:55:13 +0000 https://vulnerability.circl.lu/vuln/cve-2024-56568 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>iommu/arm-smmu: Defer probe of clients after smmu device bound</p> <p>Null pointer dereference occurs due to a race between smmu driver probe and client driver probe, when of_dma_configure() for client is called after the iommu_device_register() for smmu driver probe has executed but before the driver_bound() for smmu driver has been called.</p> <p>Following is how the race occurs:</p> <p>T1:Smmu device probe T2: Client device probe</p> <p>really_probe() arm_smmu_device_probe() iommu_device_register() really_probe() platform_dma_configure() of_dma_configure() of_dma_configure_id() of_iommu_configure() iommu_probe_device() iommu_init_device() arm_smmu_probe_device() arm_smmu_get_by_fwnode() driver_find_device_by_fwnode() driver_find_device() next_device() klist_next() /* null ptr assigned to smmu */ /* null ptr dereference while smmu-&gt;streamid_mask */ driver_bound() klist_add_tail()</p> <p>When this null smmu pointer is dereferenced later in arm_smmu_probe_device, the device crashes.</p> <p>Fix this by deferring the probe of the client device until the smmu device has bound to the arm smmu driver.</p> <p>[will: Add comment]</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>iommu/arm-smmu: Defer probe of clients after smmu device bound</p> <p>Null pointer dereference occurs due to a race between smmu driver probe and client driver probe, when of_dma_configure() for client is called after the iommu_device_register() for smmu driver probe has executed but before the driver_bound() for smmu driver has been called.</p> <p>Following is how the race occurs:</p> <p>T1:Smmu device probe T2: Client device probe</p> <p>really_probe() arm_smmu_device_probe() iommu_device_register() really_probe() platform_dma_configure() of_dma_configure() of_dma_configure_id() of_iommu_configure() iommu_probe_device() iommu_init_device() arm_smmu_probe_device() arm_smmu_get_by_fwnode() driver_find_device_by_fwnode() driver_find_device() next_device() klist_next() /* null ptr assigned to smmu */ /* null ptr dereference while smmu-&gt;streamid_mask */ driver_bound() klist_add_tail()</p> <p>When this null smmu pointer is dereferenced later in arm_smmu_probe_device, the device crashes.</p> <p>Fix this by deferring the probe of the client device until the smmu device has bound to the arm smmu driver.</p> <p>[will: Add comment]</p> https://vulnerability.circl.lu/vuln/cve-2024-56568