CVE-2024-42122: Add .vulnerable file
The issue fixed by commit 8e65a1b7118acf6af96449e1e66b7adbc9396912 is
missing NULL pointer checks after memory allocation calls (kzalloc and
dm_helpers_allocate_gpu_mem). These missing checks were introduced by
multiple commits over the span of 2020-2022 when adding support for
various DCN (Display Core Next) hardware blocks.
Timeline and Root Causes:
1. Commit 4d55b0dd1cdd8 (May 21, 2020) - "drm/amd/display: Add DCN3
CLK_MGR"
- Introduced: Missing NULL check for clk_mgr->base.bw_params =
kzalloc(...) in dcn3_clk_mgr_construct()
- Author: Bhawanpreet Lakha
2. Commit 5dba4991fd338 (May 21, 2020) - "drm/amd/display: Add DCN3
Resource"
- Introduced: Missing NULL check for pipes = kzalloc(...) in
dcn30_validate_bandwidth()
- Author: Bhawanpreet Lakha
3. Commit dd827a489c955 (June 15, 2020) - "drm/amd/display: Preserve
gpu memory allocation for life of dc"
- Introduced: Missing NULL check for clk_mgr->wm_range_table =
dm_helpers_allocate_gpu_mem(...) in dcn3_clk_mgr_construct()
- Author: Joshua Aberback
4. Commit 3bc8d9214679c (August 3, 2021) - "drm/amd/display: Add DP 2.0
HPO Link Encoder"
- Introduced: Missing NULL check for hpo_dp_enc31 = kzalloc(...) in
dcn31_hpo_dp_link_encoder_create()
- Author: Fangzhi Zuo
5. Commit 265280b99822e (February 21, 2022) - "drm/amd/display: add
CLKMGR changes for DCN32/321"
- Introduced: Missing NULL checks for both clk_mgr->base.bw_params
and clk_mgr->wm_range_table allocations in
dcn32_clk_mgr_construct()
- Author: Aurabindo Pillai
The fundamental issue is a violation of basic defensive programming
practices. When dynamic memory allocation functions like kzalloc() or
dm_helpers_allocate_gpu_mem() are called, they can fail and return NULL
if:
- The system is out of memory
- The requested size is too large
- Memory fragmentation prevents allocation
Without NULL checks, the code would dereference these NULL pointers,
leading to:
1. Kernel panics/crashes - Dereferencing NULL in kernel space typically
causes a system crash
2. Security vulnerabilities - Potential for exploitation if the NULL
dereference can be controlled
3. System instability - Even if not immediately crashing, corruption
could occur
The pattern shows this was a systemic issue in the AMD display driver
development process where memory allocation error handling was
consistently overlooked when adding new hardware support. The issue
persisted across multiple developers and over nearly 2 years before
being comprehensively fixed.
Signed-off-by: Sasha Levin <sashal@kernel.org>
1 file changed
