Bug 1259540

Summary:	[Radeon/Tonga] use-after-free traps IOMMU
Product:	[Fedora] Fedora	Reporter:	Edward O'Callaghan <edward.ocallaghan>
Component:	libdrm	Assignee:	Adam Jackson <ajax>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	23	CC:	ajax, ignatenko, rclark
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-09-22 17:28:08 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Edward O'Callaghan 2015-09-03 00:39:38 UTC

Description of problem:

libdrm needs a version bump or to back port a use-after-free patch else the IOMMU will trap on wayland and possibly under X causing segmentation faults due to out of bounds memory access on the aperture.

The following bug report contains details of the issue:

 https://bugs.freedesktop.org/show_bug.cgi?id=91704

and the fix was merged here:

 http://cgit.freedesktop.org/mesa/drm/commit/?id=5c42b5e36a4a02e579ec5dcdc3a95ce58538224c

Version-Release number of selected component (if applicable):

libdrm-2.4.64

Many thanks,
Edward.

Comment 1 Edward O'Callaghan 2015-09-07 11:03:49 UTC

Hi,

After looking over this again, the severity should be perhaps considered urgent as this could possibly be used as a exploit vector although I have not written a proof of concept yet.

Regards,

Comment 2 Edward O'Callaghan 2015-09-16 14:56:01 UTC

Fixed in version 2.4.65 which was bumped here:

http://cgit.freedesktop.org/mesa/drm/commit/?id=c3496167637e35cf8a52d5e7e53a412e79d80db0

Awaiting a RPM rebuild with the version bump now..

Comment 3 Igor Gnatenko 2015-09-22 17:28:08 UTC

2.4.65 is in rawhide and will update in f23 as well.