CVE-2021-47047

What it actually does

Failure to return error when dma_map_single fails in spi-zynqmp-gqspi driver allows continued DMA operations using invalid addresses, leading to kernel paging faults and memory corruption during large transfers.

Why it matters to the business

Systems performing large SPI flash reads on affected hardware can experience unexpected kernel crashes resulting in denial of service and potential data loss or service interruption; low exploitability and lack of known campaigns reduce immediate risk but patch urgency remains for stability.

How an attack unfolds

An attacker with local access triggers repeated large DMA reads from flash on the ZynqMP QSPI controller to exhaust swiotlb buffers, forcing the driver to proceed with an unmapped address and induce a kernel oops.

How to fix it

Update the Linux kernel to a version containing the fix that sets 44-bit dma_addr_t width and returns -ENOMEM immediately on dma_map_single failure; apply the commit that resolves the swiotlb exhaustion path.

How to confirm the fix worked

Inspect kernel source for the updated dma mapping logic and error return; reproduce large SPI transfers under memory pressure to confirm no crash occurs; verify absence of the described oops in dmesg after testing.

Typical attack path

1. Obtain local execution on target system
2. Issue large block read operation via SPI flash
3. Exhaust swiotlb slots causing dma_map_single failure
4. Driver continues DMA with invalid address
5. Trigger kernel paging fault and crash

How to detect it

Search kernel logs (dmesg, syslog) for swiotlb buffer exhaustion messages followed by memory mapping errors and paging request faults during SPI operations; correlate with processes performing large flash reads.

• swiotlb buffer is full (sz: 4194304 bytes)
• ERR:rxdma:memory not mapped
• Unable to handle kernel paging request at virtual address
• zynqmp-qspi.*spi: ERR:rxdma

What your security team should do

• Prioritize kernel updates on embedded or ZynqMP-based systems handling SPI DMA
• Enable kernel panic logging and monitoring for swiotlb-related errors
• Restrict untrusted local access to reduce trigger surface
• Test SPI workloads with constrained DMA buffers to validate stability