In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix variable 'mcafuncs' dereferenced before NULL check in 'amdgpumcasmugetmcaentry()'
Fixes the below:
drivers/gpu/drm/amd/amdgpu/amdgpumca.c:377 amdgpumcasmugetmcaentry() warn: variable dereferenced before check 'mca_funcs' (see line 368)
357 int amdgpumcasmugetmcaentry(struct amdgpudevice *adev, enum amdgpumcaerrortype type, 358 int idx, struct mcabankentry *entry) 359 { 360 const struct amdgpumcasmufuncs *mcafuncs = adev->mca.mcafuncs; 361 int count; 362 363 switch (type) { 364 case AMDGPUMCAERRORTYPEUE: 365 count = mcafuncs->maxue_count;
mca_funcs is dereferenced here.
366 break; 367 case AMDGPUMCAERRORTYPECE: 368 count = mcafuncs->maxce_count;
mca_funcs is dereferenced here.
369 break; 370 default: 371 return -EINVAL; 372 } 373 374 if (idx >= count) 375 return -EINVAL; 376 377 if (mcafuncs && mcafuncs->mcagetmca_entry) ^^^^^^^^^
Checked too late!
[
{
"id": "CVE-2024-26672-0d6691b2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f32504a2f85a7b40fe149436881381f48e9c0c0",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "amdgpu_mca_smu_get_mca_entry",
"file": "drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c"
},
"digest": {
"length": 485.0,
"function_hash": "208040565567925268128484526407904999733"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-26672-92150b29",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f32504a2f85a7b40fe149436881381f48e9c0c0",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"291807511446175026465162996719762352833",
"142565068778779082533873855242900182647",
"124521928328595382216312832849322021755",
"316388841235666400501530866690539091047",
"84309369830240284013253637398357754620",
"122929251067303643592806107525223353890",
"139857048210855263221099613017612909921",
"143799055775292398652002753506447870769",
"320256429935366176040553867840100570895"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2024-26672-c478d267",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b5d58c07024516c0e81b95e98f37710cf402c53",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"291807511446175026465162996719762352833",
"142565068778779082533873855242900182647",
"124521928328595382216312832849322021755",
"316388841235666400501530866690539091047",
"84309369830240284013253637398357754620",
"122929251067303643592806107525223353890",
"139857048210855263221099613017612909921",
"143799055775292398652002753506447870769",
"320256429935366176040553867840100570895"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2024-26672-cf39953b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b5d58c07024516c0e81b95e98f37710cf402c53",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "amdgpu_mca_smu_get_mca_entry",
"file": "drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c"
},
"digest": {
"length": 485.0,
"function_hash": "208040565567925268128484526407904999733"
},
"signature_type": "Function"
}
]