In the Linux kernel, the following vulnerability has been resolved:
drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails
Calling a6xxdestroy() before adrenogpu_init() leads to a null pointer dereference on:
msmgpucleanup() : platformsetdrvdata(gpu->pdev, NULL);
as gpu->pdev is only assigned in:
a6xxgpuinit() |_ adrenogpuinit |_ msmgpuinit()
Instead of relying on handwavy null checks down the cleanup chain, explicitly de-allocate the LLC data and free a6xx_gpu instead.
Patchwork: https://patchwork.freedesktop.org/patch/588919/
[ { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@247849eeb3fd88f8990ed73e33af70d5c10f9aec", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/msm/adreno/a6xx_gpu.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "235870942015542144516892896042023387835", "252014107403090732321664659766279994985", "175197351927993300101585479742075658824", "246535056599433082839557692262816450687" ] }, "id": "CVE-2024-38390-03c047d8" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@617e3d1680504a3f9d88e1582892c68be155498f", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/msm/adreno/a6xx_gpu.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "151195978522551860234729475716115023955", "26235712522057535830889706516502009592", "175197351927993300101585479742075658824", "106767348093156794044585555905583056155" ] }, "id": "CVE-2024-38390-252a282e" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46d4efcccc688cbacdd70a238bedca510acaa8e4", "signature_version": "v1", "target": { "function": "a6xx_gpu_init", "file": "drivers/gpu/drm/msm/adreno/a6xx_gpu.c" }, "digest": { "function_hash": "278664855882498658931727816816046607520", "length": 1655.0 }, "id": "CVE-2024-38390-48219a05" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@247849eeb3fd88f8990ed73e33af70d5c10f9aec", "signature_version": "v1", "target": { "function": "a6xx_gpu_init", "file": "drivers/gpu/drm/msm/adreno/a6xx_gpu.c" }, "digest": { "function_hash": "81378253902101115251108939419104778552", "length": 1262.0 }, "id": "CVE-2024-38390-6cc24a27" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a1955a6df91355fef72a3a254700acd3cc1fec0d", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/msm/adreno/a6xx_gpu.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "179617280416943390284596282867425035926", "26235712522057535830889706516502009592", "175197351927993300101585479742075658824", "48221024041215028836516586270194216379" ] }, "id": "CVE-2024-38390-86fe9d2d" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@617e3d1680504a3f9d88e1582892c68be155498f", "signature_version": "v1", "target": { "function": "a6xx_gpu_init", "file": "drivers/gpu/drm/msm/adreno/a6xx_gpu.c" }, "digest": { "function_hash": "278664855882498658931727816816046607520", "length": 1655.0 }, "id": "CVE-2024-38390-917766b7" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a1955a6df91355fef72a3a254700acd3cc1fec0d", "signature_version": "v1", "target": { "function": "a6xx_gpu_init", "file": "drivers/gpu/drm/msm/adreno/a6xx_gpu.c" }, "digest": { "function_hash": "278992476411532522597258423792944016435", "length": 1407.0 }, "id": "CVE-2024-38390-df7a3fcd" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46d4efcccc688cbacdd70a238bedca510acaa8e4", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/msm/adreno/a6xx_gpu.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "151195978522551860234729475716115023955", "26235712522057535830889706516502009592", "175197351927993300101585479742075658824", "106767348093156794044585555905583056155" ] }, "id": "CVE-2024-38390-f775f8ab" } ]