In the Linux kernel, the following vulnerability has been resolved:
drm/lima: mask irqs in timeout path before hard reset
There is a race condition in which a rendering job might take just long enough to trigger the drm sched job timeout handler but also still complete before the hard reset is done by the timeout handler. This runs into race conditions not expected by the timeout handler. In some very specific cases it currently may result in a refcount imbalance on limapmidle, with a stack dump such as:
[10136.669170] WARNING: CPU: 0 PID: 0 at drivers/gpu/drm/lima/limadevfreq.c:205 limadevfreqrecordidle+0xa0/0xb0 ... [10136.669459] pc : limadevfreqrecordidle+0xa0/0xb0 ... [10136.669628] Call trace: [10136.669634] limadevfreqrecordidle+0xa0/0xb0 [10136.669646] limaschedpipetaskdone+0x5c/0xb0 [10136.669656] limagpirqhandler+0xa8/0x120 [10136.669666] _handleirqeventpercpu+0x48/0x160 [10136.669679] handleirq_event+0x4c/0xc0
We can prevent that race condition entirely by masking the irqs at the beginning of the timeout handler, at which point we give up on waiting for that job entirely. The irqs will be enabled again at the next hard reset which is already done as a recovery by the timeout handler.
[
    {
        "deprecated": false,
        "target": {
            "function": "lima_sched_timedout_job",
            "file": "drivers/gpu/drm/lima/lima_sched.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70aa1f2dec46b6fdb5f6b9f37b6bfa4a4dee0d3a",
        "digest": {
            "function_hash": "224664477112173894027570644049720813399",
            "length": 696.0
        },
        "id": "CVE-2024-40976-2e1859ee",
        "signature_type": "Function"
    },
    {
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/lima/lima_sched.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03e7b2f7ae4c0ae5fb8e4e2454ba4008877f196a",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "319912956149009233048728537027815877264",
                "163882531839999092971621060904302100309",
                "112491955794852529905788808311356487291"
            ]
        },
        "id": "CVE-2024-40976-43a96fcd",
        "signature_type": "Line"
    },
    {
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/lima/lima_sched.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a421cc7a6a001b70415aa4f66024fa6178885a14",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "309323126774686252170799098687043299111",
                "299310983572813769585930551311156748876",
                "158933148995348252016161381202617778578"
            ]
        },
        "id": "CVE-2024-40976-5383064b",
        "signature_type": "Line"
    },
    {
        "deprecated": false,
        "target": {
            "function": "lima_sched_timedout_job",
            "file": "drivers/gpu/drm/lima/lima_sched.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bdbc4ca77f5eaac15de7230814253cddfed273b1",
        "digest": {
            "function_hash": "2776953603759251101345546171585133777",
            "length": 724.0
        },
        "id": "CVE-2024-40976-56758978",
        "signature_type": "Function"
    },
    {
        "deprecated": false,
        "target": {
            "function": "lima_sched_timedout_job",
            "file": "drivers/gpu/drm/lima/lima_sched.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9fd8ddd23793a50dbcd11c6ba51f437f1ea7d344",
        "digest": {
            "function_hash": "2776953603759251101345546171585133777",
            "length": 724.0
        },
        "id": "CVE-2024-40976-662c18d2",
        "signature_type": "Function"
    },
    {
        "deprecated": false,
        "target": {
            "function": "lima_sched_timedout_job",
            "file": "drivers/gpu/drm/lima/lima_sched.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a421cc7a6a001b70415aa4f66024fa6178885a14",
        "digest": {
            "function_hash": "312180940477907587000593097085252026871",
            "length": 1237.0
        },
        "id": "CVE-2024-40976-775a57c9",
        "signature_type": "Function"
    },
    {
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/lima/lima_sched.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58bfd311c93d66d8282bf21ebbf35cc3bb8ad9db",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "309323126774686252170799098687043299111",
                "299310983572813769585930551311156748876",
                "158933148995348252016161381202617778578"
            ]
        },
        "id": "CVE-2024-40976-7e6e742d",
        "signature_type": "Line"
    },
    {
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/lima/lima_sched.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9fd8ddd23793a50dbcd11c6ba51f437f1ea7d344",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "319912956149009233048728537027815877264",
                "163882531839999092971621060904302100309",
                "112491955794852529905788808311356487291"
            ]
        },
        "id": "CVE-2024-40976-baa54d7b",
        "signature_type": "Line"
    },
    {
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/lima/lima_sched.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70aa1f2dec46b6fdb5f6b9f37b6bfa4a4dee0d3a",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "319912956149009233048728537027815877264",
                "163882531839999092971621060904302100309",
                "112491955794852529905788808311356487291"
            ]
        },
        "id": "CVE-2024-40976-c1e1b3fe",
        "signature_type": "Line"
    },
    {
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/lima/lima_sched.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bdbc4ca77f5eaac15de7230814253cddfed273b1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "319912956149009233048728537027815877264",
                "163882531839999092971621060904302100309",
                "112491955794852529905788808311356487291"
            ]
        },
        "id": "CVE-2024-40976-cf4449e9",
        "signature_type": "Line"
    },
    {
        "deprecated": false,
        "target": {
            "function": "lima_sched_timedout_job",
            "file": "drivers/gpu/drm/lima/lima_sched.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03e7b2f7ae4c0ae5fb8e4e2454ba4008877f196a",
        "digest": {
            "function_hash": "230615387788566123063008463272115663723",
            "length": 660.0
        },
        "id": "CVE-2024-40976-d20a50ce",
        "signature_type": "Function"
    },
    {
        "deprecated": false,
        "target": {
            "function": "lima_sched_timedout_job",
            "file": "drivers/gpu/drm/lima/lima_sched.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58bfd311c93d66d8282bf21ebbf35cc3bb8ad9db",
        "digest": {
            "function_hash": "312180940477907587000593097085252026871",
            "length": 1237.0
        },
        "id": "CVE-2024-40976-df1b4ccb",
        "signature_type": "Function"
    }
]