CVE-2024-26667 drm/msm/dpu: check for valid hw_pp in dpu_encoder_helper_phys_cleanup

2024-04-0206:22:15

Linux

github.com

linux kernel

vulnerability

drm/msm/dpu

commit

smatch warning

conditional block

patchwork

cve

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dpu: check for valid hw_pp in dpu_encoder_helper_phys_cleanup

The commit 8b45a26f2ba9 (“drm/msm/dpu: reserve cdm blocks for writeback
in case of YUV output”) introduced a smatch warning about another
conditional block in dpu_encoder_helper_phys_cleanup() which had assumed
hw_pp will always be valid which may not necessarily be true.

Lets fix the other conditional block by making sure hw_pp is valid
before dereferencing it.

Patchwork: https://patchwork.freedesktop.org/patch/574878/

CNA Affected

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "ae4d721ce100",
        "lessThan": "fb8bfc6ea3cd",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ae4d721ce100",
        "lessThan": "79592a6e7bdc",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ae4d721ce100",
        "lessThan": "eb4f56f3ff57",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ae4d721ce100",
        "lessThan": "7f3d03c48b1e",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.19"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.19",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "6.1.78",
        "versionType": "custom",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.17",
        "versionType": "custom",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.7.5",
        "versionType": "custom",
        "lessThanOrEqual": "6.7.*"
      },
      {
        "status": "unaffected",
        "version": "6.8",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c"
    ],
    "defaultStatus": "affected"
  }
]