CVE-2026-90429: iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init

CVE-2026-90429: iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init

A user VINTF is torn down by tegra241_cmdqv_deinit_vintf(), which runs from
the destroy callback and from the init-failure unwind in the alloc handler.
It clears the cmdqv->vintfs[] slot and lets the iommufd core free it, but
nothing serializes that against the error interrupt: tegra241_cmdqv_isr()
reads cmdqv->vintfs[idx] and dereferences the vintf. A concurrent error can
make the ISR read a slot mid-clear (a NULL deref) or use a vintf which is
about to be freed (a use-after-free).

deinit_vintf() also returns idx to the IDA before clearing the slot, so a
concurrent create that reuses idx can publish its new vintf into the slot,
only for this teardown to erase it again with the stale NULL store.

On the other end, tegra241_cmdqv_init_vintf() publishes a new vintf with a
plain store to the cmdqv->vintfs[] slot, and the ISR dereferences fields of
a published vintf such as vintf->base. A plain store gives no ordering on a
weakly-ordered CPU, and a stale VINTF_ERR_MAP bit on a reused idx can make
the ISR pick a vintf the moment it is published, before its fields are set
or tegra241_vintf_hw_init() runs.

The cmdqv->vintfs[0] slot stays NULL until tegra241_cmdqv_init_structures()
first creates VINTF0, so the slot 0 read needs the same NULL check.

Publish every slot with an smp_store_release(), and read each slot in the
ISR with an smp_load_acquire() under a NULL check, so the ISR always sees
a fully built vintf or NULL. Also make deinit_vintf() clear the slot, and
synchronize_irq() prior to returning idx to the IDA, so no vintf is freed
under a running handler and no reused idx is clobbered.

The Linux kernel CVE team has assigned CVE-2026-90429 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.17 with commit 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 and fixed in 6.18.52 with commit bcb82407633c3008362ad927699d985ee4981557
	Issue introduced in 6.17 with commit 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 and fixed in 7.2.6 with commit f3ef4abc271a1d3d7b6715879e149c286dc8aae7
	Issue introduced in 6.17 with commit 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 and fixed in 7.3-rc1 with commit a491be376abd1c80a314cdd658632c85cd660b73

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-90429
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/bcb82407633c3008362ad927699d985ee4981557
	https://git.kernel.org/stable/c/f3ef4abc271a1d3d7b6715879e149c286dc8aae7
	https://git.kernel.org/stable/c/a491be376abd1c80a314cdd658632c85cd660b73