In the Linux kernel, the following vulnerability has been resolved:
drm/panfrost: Job should reference MMU not file_priv
For a while now it's been allowed for a MMU context to outlive it's corresponding panfrostpriv, however the job structure still references panfrostpriv to get hold of the MMU context. If panfrost_priv has been freed this is a use-after-free which I've been able to trigger resulting in a splat.
To fix this, drop the reference to panfrost_priv in the job structure and add a direct reference to the MMU structure which is what's actually needed.
{ "vanir_signatures": [ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c8e8cc91a6ffc79865108279a74fd57d9070a17", "deprecated": false, "digest": { "length": 1354.0, "function_hash": "199353838205147328617569906790614021742" }, "id": "CVE-2022-49359-01396a5c", "signature_type": "Function", "signature_version": "v1", "target": { "function": "panfrost_job_hw_submit", "file": "drivers/gpu/drm/panfrost/panfrost_job.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c8e8cc91a6ffc79865108279a74fd57d9070a17", "deprecated": false, "digest": { "length": 1304.0, "function_hash": "218934588817131721025788090359683181725" }, "id": "CVE-2022-49359-0faab77c", "signature_type": "Function", "signature_version": "v1", "target": { "function": "panfrost_ioctl_submit", "file": "drivers/gpu/drm/panfrost/panfrost_drv.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e516faf04317db2c46cbec4e3b78b4653a5b109", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "248836415885472396000619198015235016921", "310249484868560016620956614658131206904", "2442995889360106986540234724548197963", "232738550884025785424167648644929806697", "316209028956903021657980606080822450724", "24874590130984593412044807699499139201", "15577680844941849344864906448942326739", "147250896308099023743026510670482439205", "208044688449037214112255594690454103557", "264286630153545815118690246979458286045", "272304380641389850374544198532665990970" ] }, "id": "CVE-2022-49359-0fbb5a19", "signature_type": "Line", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/panfrost/panfrost_drv.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e516faf04317db2c46cbec4e3b78b4653a5b109", "deprecated": false, "digest": { "length": 225.0, "function_hash": "142807778308954391988485919804362936397" }, "id": "CVE-2022-49359-1576b015", "signature_type": "Function", "signature_version": "v1", "target": { "function": "panfrost_job_handle_done", "file": "drivers/gpu/drm/panfrost/panfrost_job.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@472dd7ea5e19a1aeabf1711ddc756777e05ee7c2", "deprecated": false, "digest": { "length": 1293.0, "function_hash": "117963291436483285797687692800834126296" }, "id": "CVE-2022-49359-245e06c0", "signature_type": "Function", "signature_version": "v1", "target": { "function": "panfrost_job_handle_err", "file": "drivers/gpu/drm/panfrost/panfrost_job.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c8e8cc91a6ffc79865108279a74fd57d9070a17", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "306583361989027351022360401824198207046", "329026527174189022055104917745430533506", "17021032961320015117908072314091482118", "139524272916451895466140881770042365210" ] }, "id": "CVE-2022-49359-348e0935", "signature_type": "Line", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/panfrost/panfrost_job.h" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c8e8cc91a6ffc79865108279a74fd57d9070a17", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "248836415885472396000619198015235016921", "310249484868560016620956614658131206904", "2442995889360106986540234724548197963", "232738550884025785424167648644929806697", "316209028956903021657980606080822450724", "24874590130984593412044807699499139201", "15577680844941849344864906448942326739", "147250896308099023743026510670482439205", "208044688449037214112255594690454103557", "264286630153545815118690246979458286045", "272304380641389850374544198532665990970" ] }, "id": "CVE-2022-49359-4a8f350f", "signature_type": "Line", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/panfrost/panfrost_drv.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@472dd7ea5e19a1aeabf1711ddc756777e05ee7c2", "deprecated": false, "digest": { "length": 1354.0, "function_hash": "199353838205147328617569906790614021742" }, "id": "CVE-2022-49359-4e192cb7", "signature_type": "Function", "signature_version": "v1", "target": { "function": "panfrost_job_hw_submit", "file": "drivers/gpu/drm/panfrost/panfrost_job.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@472dd7ea5e19a1aeabf1711ddc756777e05ee7c2", "deprecated": false, "digest": { "length": 225.0, "function_hash": "142807778308954391988485919804362936397" }, "id": "CVE-2022-49359-5254b444", "signature_type": "Function", "signature_version": "v1", "target": { "function": "panfrost_job_handle_done", "file": "drivers/gpu/drm/panfrost/panfrost_job.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c8e8cc91a6ffc79865108279a74fd57d9070a17", "deprecated": false, "digest": { "length": 225.0, "function_hash": "142807778308954391988485919804362936397" }, "id": "CVE-2022-49359-6c23cf1e", "signature_type": "Function", "signature_version": "v1", "target": { "function": "panfrost_job_handle_done", "file": "drivers/gpu/drm/panfrost/panfrost_job.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e516faf04317db2c46cbec4e3b78b4653a5b109", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "306583361989027351022360401824198207046", "329026527174189022055104917745430533506", "17021032961320015117908072314091482118", "139524272916451895466140881770042365210" ] }, "id": "CVE-2022-49359-726498c8", "signature_type": "Line", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/panfrost/panfrost_job.h" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@472dd7ea5e19a1aeabf1711ddc756777e05ee7c2", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "306583361989027351022360401824198207046", "329026527174189022055104917745430533506", "17021032961320015117908072314091482118", "139524272916451895466140881770042365210" ] }, "id": "CVE-2022-49359-91c3a9f6", "signature_type": "Line", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/panfrost/panfrost_job.h" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e516faf04317db2c46cbec4e3b78b4653a5b109", "deprecated": false, "digest": { "length": 1304.0, "function_hash": "218934588817131721025788090359683181725" }, "id": "CVE-2022-49359-9ef0d3d8", "signature_type": "Function", "signature_version": "v1", "target": { "function": "panfrost_ioctl_submit", "file": "drivers/gpu/drm/panfrost/panfrost_drv.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e516faf04317db2c46cbec4e3b78b4653a5b109", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "73146691979150245655526891826213907827", "3019071414512483029001977019706983089", "316704974291187931247407591619660397336", "303385496453730305004471316972624120864", "320227316112254312133568135358978800373", "12802153883655746219270253444199967854", "43145273952253776212963940435662321792", "265971541378826603388103716760553552064", "284120935072370516511381979823146252606", "20887821156410485144977397092454972287", "121294980593195236710894402194070574677", "74863956660643148232067340770019882418" ] }, "id": "CVE-2022-49359-a7fcea88", "signature_type": "Line", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/panfrost/panfrost_job.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@472dd7ea5e19a1aeabf1711ddc756777e05ee7c2", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "248836415885472396000619198015235016921", "310249484868560016620956614658131206904", "2442995889360106986540234724548197963", "232738550884025785424167648644929806697", "316209028956903021657980606080822450724", "24874590130984593412044807699499139201", "15577680844941849344864906448942326739", "147250896308099023743026510670482439205", "208044688449037214112255594690454103557", "264286630153545815118690246979458286045", "272304380641389850374544198532665990970" ] }, "id": "CVE-2022-49359-c39884b1", "signature_type": "Line", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/panfrost/panfrost_drv.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@472dd7ea5e19a1aeabf1711ddc756777e05ee7c2", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "73146691979150245655526891826213907827", "3019071414512483029001977019706983089", "316704974291187931247407591619660397336", "303385496453730305004471316972624120864", "320227316112254312133568135358978800373", "12802153883655746219270253444199967854", "43145273952253776212963940435662321792", "265971541378826603388103716760553552064", "284120935072370516511381979823146252606", "20887821156410485144977397092454972287", "121294980593195236710894402194070574677", "74863956660643148232067340770019882418" ] }, "id": "CVE-2022-49359-d49cd75f", "signature_type": "Line", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/panfrost/panfrost_job.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c8e8cc91a6ffc79865108279a74fd57d9070a17", "deprecated": false, "digest": { "length": 1293.0, "function_hash": "117963291436483285797687692800834126296" }, "id": "CVE-2022-49359-dacfec96", "signature_type": "Function", "signature_version": "v1", "target": { "function": "panfrost_job_handle_err", "file": "drivers/gpu/drm/panfrost/panfrost_job.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e516faf04317db2c46cbec4e3b78b4653a5b109", "deprecated": false, "digest": { "length": 1293.0, "function_hash": "117963291436483285797687692800834126296" }, "id": "CVE-2022-49359-e3d47755", "signature_type": "Function", "signature_version": "v1", "target": { "function": "panfrost_job_handle_err", "file": "drivers/gpu/drm/panfrost/panfrost_job.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e516faf04317db2c46cbec4e3b78b4653a5b109", "deprecated": false, "digest": { "length": 1354.0, "function_hash": "199353838205147328617569906790614021742" }, "id": "CVE-2022-49359-e57460bd", "signature_type": "Function", "signature_version": "v1", "target": { "function": "panfrost_job_hw_submit", "file": "drivers/gpu/drm/panfrost/panfrost_job.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c8e8cc91a6ffc79865108279a74fd57d9070a17", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "73146691979150245655526891826213907827", "3019071414512483029001977019706983089", "316704974291187931247407591619660397336", "303385496453730305004471316972624120864", "320227316112254312133568135358978800373", "12802153883655746219270253444199967854", "43145273952253776212963940435662321792", "265971541378826603388103716760553552064", "284120935072370516511381979823146252606", "20887821156410485144977397092454972287", "121294980593195236710894402194070574677", "74863956660643148232067340770019882418" ] }, "id": "CVE-2022-49359-ea971b79", "signature_type": "Line", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/panfrost/panfrost_job.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@472dd7ea5e19a1aeabf1711ddc756777e05ee7c2", "deprecated": false, "digest": { "length": 1304.0, "function_hash": "218934588817131721025788090359683181725" }, "id": "CVE-2022-49359-fcab3ad6", "signature_type": "Function", "signature_version": "v1", "target": { "function": "panfrost_ioctl_submit", "file": "drivers/gpu/drm/panfrost/panfrost_drv.c" } } ] }