Bug 2324415 (CVE-2024-50144) - CVE-2024-50144 kernel: drm/xe: fix unbalanced rpm put() with fence_fini()
Summary: CVE-2024-50144 kernel: drm/xe: fix unbalanced rpm put() with fence_fini()
Keywords:
Status: NEW
Alias: CVE-2024-50144
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2324459
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-11-07 17:01 UTC by OSIDB Bzimport
Modified: 2024-11-18 06:34 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2024-11-07 17:01:40 UTC
In the Linux kernel, the following vulnerability has been resolved:

drm/xe: fix unbalanced rpm put() with fence_fini()

Currently we can call fence_fini() twice if something goes wrong when
sending the GuC CT for the tlb request, since we signal the fence and
return an error, leading to the caller also calling fini() on the error
path in the case of stack version of the flow, which leads to an extra
rpm put() which might later cause device to enter suspend when it
shouldn't. It looks like we can just drop the fini() call since the
fence signaller side will already call this for us.

There are known mysterious splats with device going to sleep even with
an rpm ref, and this could be one candidate.

v2 (Matt B):
  - Prefer warning if we detect double fini()

(cherry picked from commit cfcbc0520d5055825f0647ab922b655688605183)


Note You need to log in before you can comment on or make changes to this bug.