linux-cve-announce - CVE-2024-45015: drm/msm/dpu: move dpu_encoder's connector assignment to atomic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024091107-CVE-2024-45015-c139@gregkh>
Date: Wed, 11 Sep 2024 17:14:11 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-45015: drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable()

For cases where the crtc's connectors_changed was set without enable/active
getting toggled , there is an atomic_enable() call followed by an
atomic_disable() but without an atomic_mode_set().

This results in a NULL ptr access for the dpu_encoder_get_drm_fmt() call in
the atomic_enable() as the dpu_encoder's connector was cleared in the
atomic_disable() but not re-assigned as there was no atomic_mode_set() call.

Fix the NULL ptr access by moving the assignment for atomic_enable() and also
use drm_atomic_get_new_connector_for_encoder() to get the connector from
the atomic_state.

Patchwork: https://patchwork.freedesktop.org/patch/606729/

The Linux kernel CVE team has assigned CVE-2024-45015 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.19 with commit 25fdd5933e4c and fixed in 6.6.48 with commit 3fb61718bcbe
	Issue introduced in 4.19 with commit 25fdd5933e4c and fixed in 6.10.7 with commit 3bacf814b6a6
	Issue introduced in 4.19 with commit 25fdd5933e4c and fixed in 6.11-rc5 with commit aedf02e46eb5

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-45015
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3fb61718bcbe309279205d1cc275a6435611dc77
	https://git.kernel.org/stable/c/3bacf814b6a61cc683c68465f175ebd938f09c52
	https://git.kernel.org/stable/c/aedf02e46eb549dac8db4821a6b9f0c6bf6e3990