CVE-2024-49989 drm/amd/display: fix double free issue during amdgpu module unload

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix double free issue during amdgpu module unload Flexible endpoints use DIGs from available inflexible endpoints, so only the encoders of inflexible links need to be freed. Otherwise, a double free issue may occ...

CVE-2024-49984

CVE-2024-49984 : In the Linux kernel DRM/V3D, there was an out-of-bounds access bug in the performance query extensions. The issue arises from copying IDs when validating the number of perfmon userspace inputs for the copy and reset extensions; the kernel did not adequately bound-check the destin...

CVE-2024-49984 drm/v3d: Prevent out of bounds access in performance query extensions

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Prevent out of bounds access in performance query extensions Check that the number of perfmons userspace is passing in the copy and reset extensions is not greater than the internal kernel storage where the ids will be...

CVE-2024-49984 drm/v3d: Prevent out of bounds access in performance query extensions

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Prevent out of bounds access in performance query extensions Check that the number of perfmons userspace is passing in the copy and reset extensions is not greater than the internal kernel storage where the ids will be...

CVE-2024-49972 drm/amd/display: Deallocate DML memory if allocation fails

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Deallocate DML memory if allocation fails Why When DC state create DML memory allocation fails, memory is not deallocated subsequently, resulting in uninitialized structure that is not NULL. How Deallocate memory...

CVE-2024-49972

CVE-2024-49972 affects the Linux kernel DRM-AMD display path. The issue arises when creating DML memory during DC state changes: if the DML memory allocation fails, previously allocated memory was not deallocated, leaving an uninitialized, non-NULL structure. The documented fix deallocates the me...

CVE-2024-49971 drm/amd/display: Increase array size of dummy_boolean

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Increase array size of dummyboolean WHY dml2coresharedmodesupport and dmlcoremodesupport access the third element of dummyboolean, i.e. hwdebug5 = &s-dummyboolean2, when dummyboolean has size of 2. Any assignment...

CVE-2024-49971 drm/amd/display: Increase array size of dummy_boolean

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Increase array size of dummyboolean WHY dml2coresharedmodesupport and dmlcoremodesupport access the third element of dummyboolean, i.e. hwdebug5 = &s-dummyboolean2, when dummyboolean has size of 2. Any assignment...

CVE-2024-49970 drm/amd/display: Implement bounds check for stream encoder creation in DCN401

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Implement bounds check for stream encoder creation in DCN401 'streamencregs' array is an array of dcn10streamencregisters structures. The array is initialized with four elements, corresponding to the four calls t...

CVE-2024-49970

CVE-2024-49970 affects the Linux kernel DRM AMD display path. The issue is a bounds check failure in dcn401_stream_encoder_create for the DCN401 encoder: the stream_enc_regs array, sized for indices 0–3, could be accessed with eng_id = 5, causing a buffer overflow and undefined behavior. The vuln...

CVE-2024-49970 drm/amd/display: Implement bounds check for stream encoder creation in DCN401

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Implement bounds check for stream encoder creation in DCN401 'streamencregs' array is an array of dcn10streamencregisters structures. The array is initialized with four elements, corresponding to the four calls t...

CVE-2024-49943

CVE-2024-49943 affects the Linux kernel DRM XE driver (guc_submit_wedged_fini). A missing locking around wedged_fini permits a use-after-free when a non-wedged queue is dereferenced concurrently with an async queue destroy. The fix is to hold the submission_state lock during the wedge-status chec...

CVE-2024-49943 drm/xe/guc_submit: add missing locking in wedged_fini

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gucsubmit: add missing locking in wedgedfini Any non-wedged queue can have a zero refcount here and can be running concurrently with an async queue destroy, therefore dereferencing the queue ptr to check wedge status after...

CVE-2024-49943 drm/xe/guc_submit: add missing locking in wedged_fini

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gucsubmit: add missing locking in wedgedfini Any non-wedged queue can have a zero refcount here and can be running concurrently with an async queue destroy, therefore dereferencing the queue ptr to check wedge status after...

CVE-2024-49942 drm/xe: Prevent null pointer access in xe_migrate_copy

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Prevent null pointer access in xemigratecopy xemigratecopy designed to copy content of TTM resources. When source resource is null, it will trigger a NULL pointer dereference in xemigratecopy. To avoid this situation,...

CVE-2024-49943 drm/xe/guc_submit: add missing locking in wedged_fini

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gucsubmit: add missing locking in wedgedfini Any non-wedged queue can have a zero refcount here and can be running concurrently with an async queue destroy, therefore dereferencing the queue ptr to check wedge status after...

CVE-2024-49923

The CVE-2024-49923 issue is in the Linux kernel’s DRM/AMD display path. Specifically, dcn20_validate_apply_pipe_split_flags could dereference a null pointer; the patch passes a non-null pointer to fix a null-dereference. Impact is limited to availability (HIGH) with local, low-complexity exploita...

CVE-2024-49923 drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Pass non-null to dcn20validateapplypipesplitflags WHAT & HOW "dcn20validateapplypipesplitflags" dereferences merge, and thus it cannot be a null pointer. Let's pass a valid pointer to avoid null dereference. This...

CVE-2024-49923 drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Pass non-null to dcn20validateapplypipesplitflags WHAT & HOW "dcn20validateapplypipesplitflags" dereferences merge, and thus it cannot be a null pointer. Let's pass a valid pointer to avoid null dereference. This...

CVE-2024-49921 drm/amd/display: Check null pointers before used

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null pointers before used WHAT & HOW Poniters, such as dc-clkmgr, are null checked previously in the same function, so Coverity warns "implies that "dc-clkmgr" might be null". As a result, these pointers ne...