CVE-2021-47554

What it actually does

Uninitialized iova_domain passed to put_iova_domain causes NULL pointer dereference and kernel crash; iova_cache_put may also be called without matching iova_cache_get.

Why it matters to the business

Unexpected system crashes and instability on Linux hosts using vdpa_sim virtual devices, reducing availability until the kernel is updated.

How an attack unfolds

An error occurs early in vdpasim_create before iova_domain initialization; on subsequent device release the cleanup path unconditionally calls put_iova_domain, dereferencing a NULL pointer and panicking the kernel.

How to fix it

Update to a kernel containing the fix that guards put_iova_domain and iova_cache_put calls with proper initialization checks.

How to confirm the fix worked

Confirm the patched kernel no longer panics when an error path is forced before iova_domain initialization; inspect dmesg for absence of the referenced BUG and WARNING.

Typical attack path

1. Trigger an early failure inside vdpasim_create or vdpasim_net_dev_add
2. Reach vdpa_release_dev and device_release without an initialized iova_domain
3. Execute put_iova_domain on the uninitialized structure
4. Cause kernel NULL pointer dereference and panic

How to detect it

Search kernel logs and crash dumps for call traces containing put_iova_domain, vdpasim_free, and __cpuhp_state_remove_instance around the time of device creation attempts.

What your security team should do

• Apply the corrected kernel version as soon as it is available in your distribution
• Reboot systems after the update and exercise vdpa device creation paths
• Add kernel panic monitoring for put_iova_domain and vdpasim_free symbols