linux-cve-announce - CVE-2023-53501: iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025100127-CVE-2023-53501-5859@gregkh>
Date: Wed,  1 Oct 2025 13:45:53 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53501: iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind

When unbinding pasid - a race condition exists vs outstanding page faults.

To prevent this, the pasid_state object contains a refcount.
    * set to 1 on pasid bind
    * incremented on each ppr notification start
    * decremented on each ppr notification done
    * decremented on pasid unbind

Since refcount_dec assumes that refcount will never reach 0:
  the current implementation causes the following to be invoked on
  pasid unbind:
        REFCOUNT_WARN("decrement hit 0; leaking memory")

Fix this issue by changing refcount_dec to refcount_dec_and_test
to explicitly handle refcount=1.

The Linux kernel CVE team has assigned CVE-2023-53501 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.15 with commit 8bc54824da4e8fcf0ed679cf09ac32f23d83254a and fixed in 5.15.132 with commit a50d60b8f2aff46dd7c7edb4a5835cdc4d432c22
	Issue introduced in 5.15 with commit 8bc54824da4e8fcf0ed679cf09ac32f23d83254a and fixed in 6.1.53 with commit 13ed255248dfbbb7f23f9170c7a537fb9ca22c73
	Issue introduced in 5.15 with commit 8bc54824da4e8fcf0ed679cf09ac32f23d83254a and fixed in 6.4.16 with commit 9ccc51be3126b25cfe9351dbffde946c925cc28a
	Issue introduced in 5.15 with commit 8bc54824da4e8fcf0ed679cf09ac32f23d83254a and fixed in 6.5.3 with commit 98d86bf32187db27946ca817c2467a5f2f7aa02f
	Issue introduced in 5.15 with commit 8bc54824da4e8fcf0ed679cf09ac32f23d83254a and fixed in 6.6 with commit 534103bcd52ca9c1fecbc70e717b4a538dc4ded8

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53501
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/iommu/amd/iommu_v2.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a50d60b8f2aff46dd7c7edb4a5835cdc4d432c22
	https://git.kernel.org/stable/c/13ed255248dfbbb7f23f9170c7a537fb9ca22c73
	https://git.kernel.org/stable/c/9ccc51be3126b25cfe9351dbffde946c925cc28a
	https://git.kernel.org/stable/c/98d86bf32187db27946ca817c2467a5f2f7aa02f
	https://git.kernel.org/stable/c/534103bcd52ca9c1fecbc70e717b4a538dc4ded8