| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-57926: drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err |
| |
| The pointer need to be set to NULL, otherwise KASAN complains about |
| use-after-free. Because in mtk_drm_bind, all private's drm are set |
| as follows. |
| |
| private->all_drm_private[i]->drm = drm; |
| |
| And drm will be released by drm_dev_put in case mtk_drm_kms_init returns |
| failure. However, the shutdown path still accesses the previous allocated |
| memory in drm_atomic_helper_shutdown. |
| |
| [ 84.874820] watchdog: watchdog0: watchdog did not stop! |
| [ 86.512054] ================================================================== |
| [ 86.513162] BUG: KASAN: use-after-free in drm_atomic_helper_shutdown+0x33c/0x378 |
| [ 86.514258] Read of size 8 at addr ffff0000d46fc068 by task shutdown/1 |
| [ 86.515213] |
| [ 86.515455] CPU: 1 UID: 0 PID: 1 Comm: shutdown Not tainted 6.13.0-rc1-mtk+gfa1a78e5d24b-dirty #55 |
| [ 86.516752] Hardware name: Unknown Product/Unknown Product, BIOS 2022.10 10/01/2022 |
| [ 86.517960] Call trace: |
| [ 86.518333] show_stack+0x20/0x38 (C) |
| [ 86.518891] dump_stack_lvl+0x90/0xd0 |
| [ 86.519443] print_report+0xf8/0x5b0 |
| [ 86.519985] kasan_report+0xb4/0x100 |
| [ 86.520526] __asan_report_load8_noabort+0x20/0x30 |
| [ 86.521240] drm_atomic_helper_shutdown+0x33c/0x378 |
| [ 86.521966] mtk_drm_shutdown+0x54/0x80 |
| [ 86.522546] platform_shutdown+0x64/0x90 |
| [ 86.523137] device_shutdown+0x260/0x5b8 |
| [ 86.523728] kernel_restart+0x78/0xf0 |
| [ 86.524282] __do_sys_reboot+0x258/0x2f0 |
| [ 86.524871] __arm64_sys_reboot+0x90/0xd8 |
| [ 86.525473] invoke_syscall+0x74/0x268 |
| [ 86.526041] el0_svc_common.constprop.0+0xb0/0x240 |
| [ 86.526751] do_el0_svc+0x4c/0x70 |
| [ 86.527251] el0_svc+0x4c/0xc0 |
| [ 86.527719] el0t_64_sync_handler+0x144/0x168 |
| [ 86.528367] el0t_64_sync+0x198/0x1a0 |
| [ 86.528920] |
| [ 86.529157] The buggy address belongs to the physical page: |
| [ 86.529972] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000d46fd4d0 pfn:0x1146fc |
| [ 86.531319] flags: 0xbfffc0000000000(node=0|zone=2|lastcpupid=0xffff) |
| [ 86.532267] raw: 0bfffc0000000000 0000000000000000 dead000000000122 0000000000000000 |
| [ 86.533390] raw: ffff0000d46fd4d0 0000000000000000 00000000ffffffff 0000000000000000 |
| [ 86.534511] page dumped because: kasan: bad access detected |
| [ 86.535323] |
| [ 86.535559] Memory state around the buggy address: |
| [ 86.536265] ffff0000d46fbf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |
| [ 86.537314] ffff0000d46fbf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |
| [ 86.538363] >ffff0000d46fc000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |
| [ 86.544733] ^ |
| [ 86.551057] ffff0000d46fc080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |
| [ 86.557510] ffff0000d46fc100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |
| [ 86.563928] ================================================================== |
| [ 86.571093] Disabling lock debugging due to kernel taint |
| [ 86.577642] Unable to handle kernel paging request at virtual address e0e9c0920000000b |
| [ 86.581834] KASAN: maybe wild-memory-access in range [0x0752049000000058-0x075204900000005f] |
| ... |
| |
| The Linux kernel CVE team has assigned CVE-2024-57926 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.4 with commit 1ef7ed48356cd5f9af2b7671956991b658d8c2ba and fixed in 6.6.72 with commit 7083b93e9755d60f0c2bcaa9d064308108280534 |
| Issue introduced in 6.4 with commit 1ef7ed48356cd5f9af2b7671956991b658d8c2ba and fixed in 6.12.10 with commit 078b2ff7da200b7532398e668eef723ad40fb516 |
| Issue introduced in 6.4 with commit 1ef7ed48356cd5f9af2b7671956991b658d8c2ba and fixed in 6.13 with commit 36684e9d88a2e2401ae26715a2e217cb4295cea7 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-57926 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/gpu/drm/mediatek/mtk_drm_drv.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/7083b93e9755d60f0c2bcaa9d064308108280534 |
| https://git.kernel.org/stable/c/078b2ff7da200b7532398e668eef723ad40fb516 |
| https://git.kernel.org/stable/c/36684e9d88a2e2401ae26715a2e217cb4295cea7 |
