CVE-2023-53501

Summary

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind

When unbinding pasid - a race condition exists vs outstanding page faults.

To prevent this, the pasid_state object contains a refcount. * set to 1 on pasid bind * incremented on each ppr notification start * decremented on each ppr notification done * decremented on pasid unbind

Since refcount_dec assumes that refcount will never reach 0: the current implementation causes the following to be invoked on pasid unbind: REFCOUNT_WARN("decrement hit 0; leaking memory")

Fix this issue by changing refcount_dec to refcount_dec_and_test to explicitly handle refcount=1.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux8bc54824da4e8fcf0ed679cf09ac32f23d83254a < a50d60b8f2aff46dd7c7edb4a5835cdc4d432c22affected
LinuxLinux8bc54824da4e8fcf0ed679cf09ac32f23d83254a < 13ed255248dfbbb7f23f9170c7a537fb9ca22c73affected
LinuxLinux8bc54824da4e8fcf0ed679cf09ac32f23d83254a < 9ccc51be3126b25cfe9351dbffde946c925cc28aaffected
LinuxLinux8bc54824da4e8fcf0ed679cf09ac32f23d83254a < 98d86bf32187db27946ca817c2467a5f2f7aa02faffected
LinuxLinux8bc54824da4e8fcf0ed679cf09ac32f23d83254a < 534103bcd52ca9c1fecbc70e717b4a538dc4ded8affected
LinuxLinux5.15affected
LinuxLinux0 < 5.15unaffected
LinuxLinux5.15.132 <= 5.15.*unaffected
LinuxLinux6.1.53 <= 6.1.*unaffected
LinuxLinux6.4.16 <= 6.4.*unaffected
LinuxLinux6.5.3 <= 6.5.*unaffected
LinuxLinux6.6 <= *unaffected

Weaknesses

References