| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-56542: drm/amd/display: fix a memleak issue when driver is removed |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| drm/amd/display: fix a memleak issue when driver is removed |
| |
| Running "modprobe amdgpu" the second time (followed by a modprobe -r |
| amdgpu) causes a call trace like: |
| |
| [ 845.212163] Memory manager not clean during takedown. |
| [ 845.212170] WARNING: CPU: 4 PID: 2481 at drivers/gpu/drm/drm_mm.c:999 drm_mm_takedown+0x2b/0x40 |
| [ 845.212177] Modules linked in: amdgpu(OE-) amddrm_ttm_helper(OE) amddrm_buddy(OE) amdxcp(OE) amd_sched(OE) drm_exec drm_suballoc_helper drm_display_helper i2c_algo_bit amdttm(OE) amdkcl(OE) cec rc_core sunrpc qrtr intel_rapl_msr intel_rapl_common snd_hda_codec_hdmi edac_mce_amd snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_usb_audio snd_hda_codec snd_usbmidi_lib kvm_amd snd_hda_core snd_ump mc snd_hwdep kvm snd_pcm snd_seq_midi snd_seq_midi_event irqbypass crct10dif_pclmul snd_rawmidi polyval_clmulni polyval_generic ghash_clmulni_intel sha256_ssse3 sha1_ssse3 snd_seq aesni_intel crypto_simd snd_seq_device cryptd snd_timer mfd_aaeon asus_nb_wmi eeepc_wmi joydev asus_wmi snd ledtrig_audio sparse_keymap ccp wmi_bmof input_leds k10temp i2c_piix4 platform_profile rapl soundcore gpio_amdpt mac_hid binfmt_misc msr parport_pc ppdev lp parport efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_logitech_hidpp hid_logitech_dj hid_generic usbhid hid ahci xhci_pci igc crc32_pclmul libahci xhci_pci_renesas video |
| [ 845.212284] wmi [last unloaded: amddrm_ttm_helper(OE)] |
| [ 845.212290] CPU: 4 PID: 2481 Comm: modprobe Tainted: G W OE 6.8.0-31-generic #31-Ubuntu |
| [ 845.212296] RIP: 0010:drm_mm_takedown+0x2b/0x40 |
| [ 845.212300] Code: 1f 44 00 00 48 8b 47 38 48 83 c7 38 48 39 f8 75 09 31 c0 31 ff e9 90 2e 86 00 55 48 c7 c7 d0 f6 8e 8a 48 89 e5 e8 f5 db 45 ff <0f> 0b 5d 31 c0 31 ff e9 74 2e 86 00 66 0f 1f 84 00 00 00 00 00 90 |
| [ 845.212302] RSP: 0018:ffffb11302127ae0 EFLAGS: 00010246 |
| [ 845.212305] RAX: 0000000000000000 RBX: ffff92aa5020fc08 RCX: 0000000000000000 |
| [ 845.212307] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 |
| [ 845.212309] RBP: ffffb11302127ae0 R08: 0000000000000000 R09: 0000000000000000 |
| [ 845.212310] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000004 |
| [ 845.212312] R13: ffff92aa50200000 R14: ffff92aa5020fb10 R15: ffff92aa5020faa0 |
| [ 845.212313] FS: 0000707dd7c7c080(0000) GS:ffff92b93de00000(0000) knlGS:0000000000000000 |
| [ 845.212316] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 |
| [ 845.212318] CR2: 00007d48b0aee200 CR3: 0000000115a58000 CR4: 0000000000f50ef0 |
| [ 845.212320] PKRU: 55555554 |
| [ 845.212321] Call Trace: |
| [ 845.212323] <TASK> |
| [ 845.212328] ? show_regs+0x6d/0x80 |
| [ 845.212333] ? __warn+0x89/0x160 |
| [ 845.212339] ? drm_mm_takedown+0x2b/0x40 |
| [ 845.212344] ? report_bug+0x17e/0x1b0 |
| [ 845.212350] ? handle_bug+0x51/0xa0 |
| [ 845.212355] ? exc_invalid_op+0x18/0x80 |
| [ 845.212359] ? asm_exc_invalid_op+0x1b/0x20 |
| [ 845.212366] ? drm_mm_takedown+0x2b/0x40 |
| [ 845.212371] amdgpu_gtt_mgr_fini+0xa9/0x130 [amdgpu] |
| [ 845.212645] amdgpu_ttm_fini+0x264/0x340 [amdgpu] |
| [ 845.212770] amdgpu_bo_fini+0x2e/0xc0 [amdgpu] |
| [ 845.212894] gmc_v12_0_sw_fini+0x2a/0x40 [amdgpu] |
| [ 845.213036] amdgpu_device_fini_sw+0x11a/0x590 [amdgpu] |
| [ 845.213159] amdgpu_driver_release_kms+0x16/0x40 [amdgpu] |
| [ 845.213302] devm_drm_dev_init_release+0x5e/0x90 |
| [ 845.213305] devm_action_release+0x12/0x30 |
| [ 845.213308] release_nodes+0x42/0xd0 |
| [ 845.213311] devres_release_all+0x97/0xe0 |
| [ 845.213314] device_unbind_cleanup+0x12/0x80 |
| [ 845.213317] device_release_driver_internal+0x230/0x270 |
| [ 845.213319] ? srso_alias_return_thunk+0x5/0xfbef5 |
| |
| This is caused by lost memory during early init phase. First time driver |
| is removed, memory is freed but when second time the driver is inserted, |
| VBIOS dmub is not active, since the PSP policy is to retain the driver |
| loaded version on subsequent warm boots. Hence, communication with VBIOS |
| DMUB fails. |
| |
| Fix this by aborting further communication with vbios dmub and release |
| the memory immediately. |
| |
| The Linux kernel CVE team has assigned CVE-2024-56542 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.11.2 with commit 43ebd0faec24652cb529ceefd594c61897059f90 and fixed in 6.11.11 with commit e51cbe40b77a32e8698ad8b9582e5b4fce6da364 |
| Issue introduced in 6.12 with commit f59549c7e705be0087d08bc116ccc767b86d8362 and fixed in 6.12.2 with commit 5860c637513036a6ffc130950ea98676b591b47c |
| Issue introduced in 6.12 with commit f59549c7e705be0087d08bc116ccc767b86d8362 and fixed in 6.13 with commit d4f36e5fd800de7db74c1c4e62baf24a091a5ff6 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-56542 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c |
| drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h |
| drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/e51cbe40b77a32e8698ad8b9582e5b4fce6da364 |
| https://git.kernel.org/stable/c/5860c637513036a6ffc130950ea98676b591b47c |
| https://git.kernel.org/stable/c/d4f36e5fd800de7db74c1c4e62baf24a091a5ff6 |
