cve/published/2024/CVE-2024-26833.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2024-26833: drm/amd/display: Fix memory leak in dm_sw_fini()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix memory leak in dm_sw_fini()

After destroying dmub_srv, the memory associated with it is
not freed, causing a memory leak:

unreferenced object 0xffff896302b45800 (size 1024):
  comm "(udev-worker)", pid 222, jiffies 4294894636
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 6265fd77):
    [<ffffffff993495ed>] kmalloc_trace+0x29d/0x340
    [<ffffffffc0ea4a94>] dm_dmub_sw_init+0xb4/0x450 [amdgpu]
    [<ffffffffc0ea4e55>] dm_sw_init+0x15/0x2b0 [amdgpu]
    [<ffffffffc0ba8557>] amdgpu_device_init+0x1417/0x24e0 [amdgpu]
    [<ffffffffc0bab285>] amdgpu_driver_load_kms+0x15/0x190 [amdgpu]
    [<ffffffffc0ba09c7>] amdgpu_pci_probe+0x187/0x4e0 [amdgpu]
    [<ffffffff9968fd1e>] local_pci_probe+0x3e/0x90
    [<ffffffff996918a3>] pci_device_probe+0xc3/0x230
    [<ffffffff99805872>] really_probe+0xe2/0x480
    [<ffffffff99805c98>] __driver_probe_device+0x78/0x160
    [<ffffffff99805daf>] driver_probe_device+0x1f/0x90
    [<ffffffff9980601e>] __driver_attach+0xce/0x1c0
    [<ffffffff99803170>] bus_for_each_dev+0x70/0xc0
    [<ffffffff99804822>] bus_add_driver+0x112/0x210
    [<ffffffff99807245>] driver_register+0x55/0x100
    [<ffffffff990012d1>] do_one_initcall+0x41/0x300

Fix this by freeing dmub_srv after destroying it.

The Linux kernel CVE team has assigned CVE-2024-26833 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.6 with commit 743b9786b14ae0d7d13b3782dccad158e577e9bb and fixed in 5.10.211 with commit b49b022f7dfce85eb77d0d987008fde5c01d7857
	Issue introduced in 5.6 with commit 743b9786b14ae0d7d13b3782dccad158e577e9bb and fixed in 5.15.150 with commit 33f649f1b1cea39ed360e6c12bba4fac83118e6e
	Issue introduced in 5.6 with commit 743b9786b14ae0d7d13b3782dccad158e577e9bb and fixed in 6.1.80 with commit 58168005337eabef345a872be3f87d0215ff3b30
	Issue introduced in 5.6 with commit 743b9786b14ae0d7d13b3782dccad158e577e9bb and fixed in 6.6.19 with commit 10c6b90e975358c17856a578419dc449887899c2
	Issue introduced in 5.6 with commit 743b9786b14ae0d7d13b3782dccad158e577e9bb and fixed in 6.7.7 with commit 541e79265ea7e339a7c4a462feafe9f8f996e04b
	Issue introduced in 5.6 with commit 743b9786b14ae0d7d13b3782dccad158e577e9bb and fixed in 6.8 with commit bae67893578d608e35691dcdfa90c4957debf1d3

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-26833
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b49b022f7dfce85eb77d0d987008fde5c01d7857
	https://git.kernel.org/stable/c/33f649f1b1cea39ed360e6c12bba4fac83118e6e
	https://git.kernel.org/stable/c/58168005337eabef345a872be3f87d0215ff3b30
	https://git.kernel.org/stable/c/10c6b90e975358c17856a578419dc449887899c2
	https://git.kernel.org/stable/c/541e79265ea7e339a7c4a462feafe9f8f996e04b
	https://git.kernel.org/stable/c/bae67893578d608e35691dcdfa90c4957debf1d3