CVE-2021-47534

The CVE-2021-47534 entry concerns a Linux kernel DRM/VC4 KMS issue: a refcounting bug in the global HVS state caused leakage of drm_crtc_commit structures on every commit. The fix introduces drm_crtc_commit_put to prevent leakage, implemented in the patch chain around commit 9ec03d7f1ed3. Affecte...

CVE-2021-47535 drm/msm/a6xx: Allocate enough space for GMU registers

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Allocate enough space for GMU registers In commit 142639a52a01 "drm/msm/a6xx: fix crashstate capture for A650" we changed a6xxgetgmuregisters to read 3 sets of registers. Unfortunately, we didn't change the memory...

CVE-2021-47533 drm/vc4: kms: Clear the HVS FIFO commit pointer once done

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: kms: Clear the HVS FIFO commit pointer once done Commit 9ec03d7f1ed3 "drm/vc4: kms: Wait on previous FIFO users before a commit" introduced a wait on the previous commit done on a given HVS FIFO. However, we never cleare...

CVE-2021-47532

CVE-2021-47532 concerns a leak in the Linux kernel related to the DRM MSM devfreq OPP reference counter. The vulnerability is described as a local issue in the kernel’s OPP handling that could leak references in the OPP (Operating Performance Point) management path within the drm/msm/devfreq subs...

CVE-2021-47533

CVE-2021-47533 affects the Linux kernel drm/vc4: kms path. A use-after-free could occur when duplicating state due to a stale HVS FIFO commit pointer not being cleared after waiting on the previous FIFO user. The fix sets the HVS FIFO commit pointer to NULL once the wait completes to prevent carr...

CVE-2021-47531 drm/msm: Fix mmap to include VM_IO and VM_DONTDUMP

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix mmap to include VMIO and VMDONTDUMP In commit 510410bfc034 "drm/msm: Implement mmap as GEM object function" we switched to a new/cleaner method of doing things. That's good, but we missed a little bit. Before that...

CVE-2021-47531 drm/msm: Fix mmap to include VM_IO and VM_DONTDUMP

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix mmap to include VMIO and VMDONTDUMP In commit 510410bfc034 "drm/msm: Implement mmap as GEM object function" we switched to a new/cleaner method of doing things. That's good, but we missed a little bit. Before that...

CVE-2021-47531

Mode C CVE-2021-47531: Linux kernel MSM DRM mmap handling fixed. The issue occurred when switching to the new mmap path (drm/msm: Implement mmap as GEM object function) and skipping the default mmap code. This caused missing VM_FLAGS and page-prot setup, contributing to crashes on ARC++ Chromeboo...

CVE-2021-47530 drm/msm: Fix wait_fence submitqueue leak

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix waitfence submitqueue leak We weren't dropping the submitqueue reference in all paths. In particular, when the fence has already been signalled. Split out a helper to simplify handling this in the various different...

CVE-2021-47530 drm/msm: Fix wait_fence submitqueue leak

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix waitfence submitqueue leak We weren't dropping the submitqueue reference in all paths. In particular, when the fence has already been signalled. Split out a helper to simplify handling this in the various different...

CVE-2021-47530

CVE-2021-47530: Linux kernel vulnerability in drm/msm where the submitqueue reference leak was not dropped across all paths, notably when the fence had already signaled. The fix (described as extracting a helper to normalize handling across different returns) resolves the leak. Public advisories ...

Linux kernel 安全漏洞

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. A security vulnerability exists in the Linux kernel, which stems from a vulnerability in the drm/msm module...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an OPP refcnt leak in the drm/msm/devfreq module...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that originates from a commit queue leak in the drm/msm module waitfence...

SUSE CVE-2021-47354

In the Linux kernel, the following vulnerability has been resolved: drm/sched: Avoid data corruptions Wait for all dependencies of a job to complete before killing it to avoid data corruptions...

SUSE CVE-2023-52826

In the Linux kernel, the following vulnerability has been resolved: drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference In tpg110getmodes, the return value of drmmodeduplicate is assigned to mode, which will lead to a NULL pointer dereference on failure of drmmodeduplicate. Add a...

CVE-2021-47253

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential memory leak in DMUB hwinit Why On resume we perform DMUB hwinit which allocates memory: dmresume-dmdmubhwinit-dcdmubsrvcreate-kzalloc That results in memory leak in suspend/resume scenarios. How...

CVE-2021-47280

A vulnerability was found in the Linux kernel's DRM, where the drmgetunique function can read a pointer after it has been freed. This occurs because the function retrieves a pointer without properly locking the device's master mutex, leading to a potential crash if another process modifies the...

CVE-2020-36788

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: avoid a use-after-free when BO init fails nouveauboinit is backed by ttmboinit and ferries its return code back to the caller. On failures, ttmboinit invokes the provided destructor which should de-initialize and fre...

CVE-2023-52826

In the Linux kernel, the following vulnerability has been resolved: drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference In tpg110getmodes, the return value of drmmodeduplicate is assigned to mode, which will lead to a NULL pointer dereference on failure of drmmodeduplicate. Add a...