| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-49489: drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume |
| |
| BUG: Unable to handle kernel paging request at virtual address 006b6b6b6b6b6be3 |
| |
| Call trace: |
| dpu_vbif_init_memtypes+0x40/0xb8 |
| dpu_runtime_resume+0xcc/0x1c0 |
| pm_generic_runtime_resume+0x30/0x44 |
| __genpd_runtime_resume+0x68/0x7c |
| genpd_runtime_resume+0x134/0x258 |
| __rpm_callback+0x98/0x138 |
| rpm_callback+0x30/0x88 |
| rpm_resume+0x36c/0x49c |
| __pm_runtime_resume+0x80/0xb0 |
| dpu_core_irq_uninstall+0x30/0xb0 |
| dpu_irq_uninstall+0x18/0x24 |
| msm_drm_uninit+0xd8/0x16c |
| |
| Patchwork: https://patchwork.freedesktop.org/patch/483255/ |
| [DB: fixed Fixes tag] |
| |
| The Linux kernel CVE team has assigned CVE-2022-49489 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.19 with commit 25fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef and fixed in 4.19.247 with commit aa4cb188988dc6f1b3f4917d4dbc452150a5d871 |
| Issue introduced in 4.19 with commit 25fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef and fixed in 5.4.198 with commit ef10d0c68e8608848cd58fca2589685718426607 |
| Issue introduced in 4.19 with commit 25fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef and fixed in 5.10.121 with commit 134760263f6441741db0b2970e7face6b34b6d1c |
| Issue introduced in 4.19 with commit 25fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef and fixed in 5.15.46 with commit ef4bdaac7cb5416f236613ed9337ff0ea8ee329b |
| Issue introduced in 4.19 with commit 25fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef and fixed in 5.17.14 with commit 97ac682b6f7d36be5d934f86c9911066540a68f1 |
| Issue introduced in 4.19 with commit 25fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef and fixed in 5.18.3 with commit 5b0adf5cbf3b74721e4e4c4e0cadc91b8df8bcc2 |
| Issue introduced in 4.19 with commit 25fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef and fixed in 5.19 with commit fa5186b279ecf44b14fb435540d2065be91cb1ed |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-49489 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/aa4cb188988dc6f1b3f4917d4dbc452150a5d871 |
| https://git.kernel.org/stable/c/ef10d0c68e8608848cd58fca2589685718426607 |
| https://git.kernel.org/stable/c/134760263f6441741db0b2970e7face6b34b6d1c |
| https://git.kernel.org/stable/c/ef4bdaac7cb5416f236613ed9337ff0ea8ee329b |
| https://git.kernel.org/stable/c/97ac682b6f7d36be5d934f86c9911066540a68f1 |
| https://git.kernel.org/stable/c/5b0adf5cbf3b74721e4e4c4e0cadc91b8df8bcc2 |
| https://git.kernel.org/stable/c/fa5186b279ecf44b14fb435540d2065be91cb1ed |
