CVE-2021-47534 drm/vc4: kms: Add missing drm_crtc_commit_put

2024-05-2415:09:43

Linux

www.cve.org

linux kernel

vulnerability

resolved

drm/vc4

kms

refcounting

hvs

fifo

drm_crtc_commit_put

leakage

AI Score

6.5

Confidence

High

EPSS

Percentile

9.0%

JSON

In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: kms: Add missing drm_crtc_commit_put

Commit 9ec03d7f1ed3 (“drm/vc4: kms: Wait on previous FIFO users before a
commit”) introduced a global state for the HVS, with each FIFO storing
the current CRTC commit so that we can properly synchronize commits.

However, the refcounting was off and we thus ended up leaking the
drm_crtc_commit structure every commit. Add a drm_crtc_commit_put to
prevent the leakage.

CNA Affected

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/gpu/drm/vc4/vc4_kms.c"
    ],
    "versions": [
      {
        "version": "9ec03d7f1ed3",
        "lessThan": "53f9601e908d",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "9ec03d7f1ed3",
        "lessThan": "049cfff8d53a",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/gpu/drm/vc4/vc4_kms.c"
    ],
    "versions": [
      {
        "version": "5.12",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "5.12",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.15.7",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.16",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]