CVE-2024-26939

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-26939
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26939.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-26939
Downstream
Related
Published
2024-05-01T05:17:44Z
Modified
2025-10-15T09:54:52.482856Z
Summary
drm/i915/vma: Fix UAF on destroy against retire race
Details

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/vma: Fix UAF on destroy against retire race

Object debugging tools were sporadically reporting illegal attempts to free a still active i915 VMA object when parking a GT believed to be idle.

[161.359441] ODEBUG: free active (active state 0) object: ffff88811643b958 object type: i915active hint: i915vmaactive+0x0/0x50 [i915] [161.360082] WARNING: CPU: 5 PID: 276 at lib/debugobjects.c:514 debugprintobject+0x80/0xb0 ... [161.360304] CPU: 5 PID: 276 Comm: kworker/5:2 Not tainted 6.5.0-rc1-CIDRM13375-g003f860e5577+ #1 [161.360314] Hardware name: Intel Corporation Rocket Lake Client Platform/RocketLake S UDIMM 6L RVP, BIOS RKLSFWI1.R00.3173.A03.2204210138 04/21/2022 [161.360322] Workqueue: i915-unordered _intelwakerefputwork [i915] [161.360592] RIP: 0010:debugprintobject+0x80/0xb0 ... [161.361347] debugobjectfree+0xeb/0x110 [161.361362] i915activefini+0x14/0x130 [i915] [161.361866] releasereferences+0xfe/0x1f0 [i915] [161.362543] i915vmaparked+0x1db/0x380 [i915] [161.363129] _gtpark+0x121/0x230 [i915] [161.363515] intelwakerefput_last+0x1f/0x70 [i915]

That has been tracked down to be happening when another thread is deactivating the VMA inside _activeretire() helper, after the VMA's active counter has been already decremented to 0, but before deactivation of the VMA's object is reported to the object debugging tool.

We could prevent from that race by serializing i915activefini() with _activeretire() via ref->treelock, but that wouldn't stop the VMA from being used, e.g. from _i915vmaretire() called at the end of _activeretire(), after that VMA has been already freed by a concurrent i915vmadestroy() on return from the i915activefini(). Then, we should rather fix the issue at the VMA level, not in i915_active.

Since _i915vmaparked() is called from _gtpark() on last put of the GT's wakeref, the issue could be addressed by holding the GT wakeref long enough for _active_retire() to complete before that wakeref is released and the GT parked.

I believe the issue was introduced by commit d93939730347 ("drm/i915: Remove the vma refcount") which moved a call to i915activefini() from a dropped i915vmarelease(), called on last put of the removed VMA kref, to i915vmaparked() processing path called on last put of a GT wakeref. However, its visibility to the object debugging tool was suppressed by a bug in i915_active that was fixed two weeks later with commit e92eb246feb9 ("drm/i915/active: Fix missing debug object activation").

A VMA associated with a request doesn't acquire a GT wakeref by itself. Instead, it depends on a wakeref held directly by the request's active intelcontext for a GT associated with its VM, and indirectly on that intelcontext's engine wakeref if the engine belongs to the same GT as the VMA's VM. Those wakerefs are released asynchronously to VMA deactivation.

Fix the issue by getting a wakeref for the VMA's GT when activating it, and putting that wakeref only after the VMA is deactivated. However, exclude global GTT from that processing path, otherwise the GPU never goes idle. Since _i915vma_retire() may be called from atomic contexts, use async variant of wakeref put. Also, to avoid circular locking dependency, take care of acquiring the wakeref before VM mutex when both are needed.

v7: Add inline comments with justifications for: - using untracked variants of intelgtpmget/put() (Nirmoy), - using async variant of _put(), - not getting the wakeref in case of a global GTT, - always getting the first wakeref outside vm->mutex. v6: Since _i915vmaactive/retire() callbacks are not serialized, storing a wakeref tracking handle inside struct i915vma is not safe, and there is no other good place for that. Use untracked variants of intelgtpmget/put_async(). v5: Replace "tile" with "GT" across commit description (Rodrigo), - ---truncated---

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
d93939730347360db0afe6a4367451b6f84ab7b1
Fixed
704edc9252f4988ae1ad7dafa23d0db8d90d7190
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
d93939730347360db0afe6a4367451b6f84ab7b1
Fixed
5e3eb862df9f972ab677fb19e0d4b9b1be8db7b5
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
d93939730347360db0afe6a4367451b6f84ab7b1
Fixed
59b2626dd8c8a2e13f18054b3530e0c00073d79f
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
d93939730347360db0afe6a4367451b6f84ab7b1
Fixed
0e45882ca829b26b915162e8e86dbb1095768e9e

Affected versions

v5.*

v5.17
v5.17-rc5
v5.17-rc6
v5.17-rc7
v5.17-rc8
v5.18
v5.18-rc1
v5.18-rc2
v5.18-rc3
v5.18-rc4
v5.18-rc5
v5.18-rc6
v5.18-rc7
v5.19
v5.19-rc1
v5.19-rc2
v5.19-rc3
v5.19-rc4
v5.19-rc5
v5.19-rc6
v5.19-rc7
v5.19-rc8

v6.*

v6.0
v6.0-rc1
v6.0-rc2
v6.0-rc3
v6.0-rc4
v6.0-rc5
v6.0-rc6
v6.0-rc7
v6.1
v6.1-rc1
v6.1-rc2
v6.1-rc3
v6.1-rc4
v6.1-rc5
v6.1-rc6
v6.1-rc7
v6.1-rc8
v6.1.1
v6.1.10
v6.1.11
v6.1.12
v6.1.13
v6.1.14
v6.1.15
v6.1.16
v6.1.17
v6.1.18
v6.1.19
v6.1.2
v6.1.20
v6.1.21
v6.1.22
v6.1.23
v6.1.24
v6.1.25
v6.1.26
v6.1.27
v6.1.28
v6.1.29
v6.1.3
v6.1.30
v6.1.31
v6.1.32
v6.1.33
v6.1.34
v6.1.35
v6.1.36
v6.1.37
v6.1.38
v6.1.39
v6.1.4
v6.1.40
v6.1.41
v6.1.42
v6.1.43
v6.1.44
v6.1.45
v6.1.46
v6.1.47
v6.1.48
v6.1.49
v6.1.5
v6.1.50
v6.1.51
v6.1.52
v6.1.53
v6.1.54
v6.1.55
v6.1.56
v6.1.57
v6.1.58
v6.1.59
v6.1.6
v6.1.60
v6.1.61
v6.1.62
v6.1.63
v6.1.64
v6.1.65
v6.1.66
v6.1.67
v6.1.68
v6.1.69
v6.1.7
v6.1.70
v6.1.71
v6.1.72
v6.1.73
v6.1.74
v6.1.75
v6.1.76
v6.1.77
v6.1.78
v6.1.79
v6.1.8
v6.1.80
v6.1.81
v6.1.82
v6.1.83
v6.1.84
v6.1.85
v6.1.86
v6.1.87
v6.1.9
v6.2
v6.2-rc1
v6.2-rc2
v6.2-rc3
v6.2-rc4
v6.2-rc5
v6.2-rc6
v6.2-rc7
v6.2-rc8
v6.3
v6.3-rc1
v6.3-rc2
v6.3-rc3
v6.3-rc4
v6.3-rc5
v6.3-rc6
v6.3-rc7
v6.4
v6.4-rc1
v6.4-rc2
v6.4-rc3
v6.4-rc4
v6.4-rc5
v6.4-rc6
v6.4-rc7
v6.5
v6.5-rc1
v6.5-rc2
v6.5-rc3
v6.5-rc4
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.15
v6.6.16
v6.6.17
v6.6.18
v6.6.19
v6.6.2
v6.6.20
v6.6.21
v6.6.22
v6.6.23
v6.6.24
v6.6.25
v6.6.26
v6.6.27
v6.6.28
v6.6.3
v6.6.4
v6.6.5
v6.6.6
v6.6.7
v6.6.8
v6.6.9
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.8.1
v6.8.2
v6.9-rc1

Database specific

{
    "vanir_signatures": [
        {
            "id": "CVE-2024-26939-173438bb",
            "target": {
                "file": "drivers/gpu/drm/i915/i915_vma.c",
                "function": "__i915_vma_active"
            },
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e3eb862df9f972ab677fb19e0d4b9b1be8db7b5",
            "digest": {
                "function_hash": "89560938694253181711420031141589015256",
                "length": 99.0
            },
            "signature_version": "v1",
            "deprecated": false,
            "signature_type": "Function"
        },
        {
            "id": "CVE-2024-26939-180c9809",
            "target": {
                "file": "drivers/gpu/drm/i915/i915_vma.c",
                "function": "__i915_vma_retire"
            },
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59b2626dd8c8a2e13f18054b3530e0c00073d79f",
            "digest": {
                "function_hash": "198116239689472689870110612360515563622",
                "length": 77.0
            },
            "signature_version": "v1",
            "deprecated": false,
            "signature_type": "Function"
        },
        {
            "id": "CVE-2024-26939-1e7788be",
            "target": {
                "file": "drivers/gpu/drm/i915/i915_vma.c"
            },
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@704edc9252f4988ae1ad7dafa23d0db8d90d7190",
            "digest": {
                "line_hashes": [
                    "322604044336653982202017686199918048098",
                    "300137707729809220316733365765524618785",
                    "123146415969646656053625205291554844492",
                    "230052555193575959683664043033547281816",
                    "60132162329688841623412447925100748135",
                    "217834674303448268222703517044703796152",
                    "186287207532467454219561263482232511091",
                    "137916975552898574280621970850329550186",
                    "338587277248999277307610604428725413844",
                    "68970407636380108871486283286117209815",
                    "327883688917683117097284843168737004808",
                    "334281989537842587928428500591302542081",
                    "230404054079661512459666037492691137028",
                    "187238178062490812549752127103181119610",
                    "132626951892688290940544422599506957720",
                    "79888908614094935648410573964520455132",
                    "4635320868242384571397598785693190431",
                    "162872386890702880971282480026340659491",
                    "5361507596542638440493847028873541192",
                    "155438112205466396553890202782751396277",
                    "197040830202348665063194246961864293817",
                    "174744495181794359953631575309273019370",
                    "335596652378216355172435799255346459427",
                    "71926745295458310110936003684728267839",
                    "202623809588942826346262741946261422230",
                    "157606679874949945952002169166156947090"
                ],
                "threshold": 0.9
            },
            "signature_version": "v1",
            "deprecated": false,
            "signature_type": "Line"
        },
        {
            "id": "CVE-2024-26939-328d421e",
            "target": {
                "file": "drivers/gpu/drm/i915/i915_vma.c",
                "function": "__i915_vma_retire"
            },
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e3eb862df9f972ab677fb19e0d4b9b1be8db7b5",
            "digest": {
                "function_hash": "198116239689472689870110612360515563622",
                "length": 77.0
            },
            "signature_version": "v1",
            "deprecated": false,
            "signature_type": "Function"
        },
        {
            "id": "CVE-2024-26939-58d15be5",
            "target": {
                "file": "drivers/gpu/drm/i915/i915_vma.c",
                "function": "__i915_vma_retire"
            },
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@704edc9252f4988ae1ad7dafa23d0db8d90d7190",
            "digest": {
                "function_hash": "198116239689472689870110612360515563622",
                "length": 77.0
            },
            "signature_version": "v1",
            "deprecated": false,
            "signature_type": "Function"
        },
        {
            "id": "CVE-2024-26939-5fac1745",
            "target": {
                "file": "drivers/gpu/drm/i915/i915_vma.c",
                "function": "i915_vma_pin_ww"
            },
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e3eb862df9f972ab677fb19e0d4b9b1be8db7b5",
            "digest": {
                "function_hash": "57105447437725513402995014506884323009",
                "length": 2953.0
            },
            "signature_version": "v1",
            "deprecated": false,
            "signature_type": "Function"
        },
        {
            "id": "CVE-2024-26939-650e1488",
            "target": {
                "file": "drivers/gpu/drm/i915/i915_vma.c"
            },
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e45882ca829b26b915162e8e86dbb1095768e9e",
            "digest": {
                "line_hashes": [
                    "322604044336653982202017686199918048098",
                    "300137707729809220316733365765524618785",
                    "240330141114133013588888954296764826645",
                    "336642334898746862503130592689555924416",
                    "60132162329688841623412447925100748135",
                    "217834674303448268222703517044703796152",
                    "186287207532467454219561263482232511091",
                    "137916975552898574280621970850329550186",
                    "338587277248999277307610604428725413844",
                    "68970407636380108871486283286117209815",
                    "327883688917683117097284843168737004808",
                    "334281989537842587928428500591302542081",
                    "230404054079661512459666037492691137028",
                    "187238178062490812549752127103181119610",
                    "132626951892688290940544422599506957720",
                    "79888908614094935648410573964520455132",
                    "4635320868242384571397598785693190431",
                    "162872386890702880971282480026340659491",
                    "5361507596542638440493847028873541192",
                    "155438112205466396553890202782751396277",
                    "197040830202348665063194246961864293817",
                    "174744495181794359953631575309273019370",
                    "335596652378216355172435799255346459427",
                    "71926745295458310110936003684728267839",
                    "202623809588942826346262741946261422230",
                    "157606679874949945952002169166156947090"
                ],
                "threshold": 0.9
            },
            "signature_version": "v1",
            "deprecated": false,
            "signature_type": "Line"
        },
        {
            "id": "CVE-2024-26939-67667f68",
            "target": {
                "file": "drivers/gpu/drm/i915/i915_vma.c",
                "function": "__i915_vma_active"
            },
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e45882ca829b26b915162e8e86dbb1095768e9e",
            "digest": {
                "function_hash": "89560938694253181711420031141589015256",
                "length": 99.0
            },
            "signature_version": "v1",
            "deprecated": false,
            "signature_type": "Function"
        },
        {
            "id": "CVE-2024-26939-69fcfb00",
            "target": {
                "file": "drivers/gpu/drm/i915/i915_vma.c",
                "function": "i915_vma_pin_ww"
            },
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e45882ca829b26b915162e8e86dbb1095768e9e",
            "digest": {
                "function_hash": "57105447437725513402995014506884323009",
                "length": 2953.0
            },
            "signature_version": "v1",
            "deprecated": false,
            "signature_type": "Function"
        },
        {
            "id": "CVE-2024-26939-80c7bf53",
            "target": {
                "file": "drivers/gpu/drm/i915/i915_vma.c",
                "function": "__i915_vma_active"
            },
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@704edc9252f4988ae1ad7dafa23d0db8d90d7190",
            "digest": {
                "function_hash": "89560938694253181711420031141589015256",
                "length": 99.0
            },
            "signature_version": "v1",
            "deprecated": false,
            "signature_type": "Function"
        },
        {
            "id": "CVE-2024-26939-83b95f43",
            "target": {
                "file": "drivers/gpu/drm/i915/i915_vma.c",
                "function": "i915_vma_pin_ww"
            },
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59b2626dd8c8a2e13f18054b3530e0c00073d79f",
            "digest": {
                "function_hash": "57105447437725513402995014506884323009",
                "length": 2953.0
            },
            "signature_version": "v1",
            "deprecated": false,
            "signature_type": "Function"
        },
        {
            "id": "CVE-2024-26939-9aaf94f7",
            "target": {
                "file": "drivers/gpu/drm/i915/i915_vma.c"
            },
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59b2626dd8c8a2e13f18054b3530e0c00073d79f",
            "digest": {
                "line_hashes": [
                    "322604044336653982202017686199918048098",
                    "300137707729809220316733365765524618785",
                    "240330141114133013588888954296764826645",
                    "336642334898746862503130592689555924416",
                    "60132162329688841623412447925100748135",
                    "217834674303448268222703517044703796152",
                    "186287207532467454219561263482232511091",
                    "137916975552898574280621970850329550186",
                    "338587277248999277307610604428725413844",
                    "68970407636380108871486283286117209815",
                    "327883688917683117097284843168737004808",
                    "334281989537842587928428500591302542081",
                    "230404054079661512459666037492691137028",
                    "187238178062490812549752127103181119610",
                    "132626951892688290940544422599506957720",
                    "79888908614094935648410573964520455132",
                    "4635320868242384571397598785693190431",
                    "162872386890702880971282480026340659491",
                    "5361507596542638440493847028873541192",
                    "155438112205466396553890202782751396277",
                    "197040830202348665063194246961864293817",
                    "174744495181794359953631575309273019370",
                    "335596652378216355172435799255346459427",
                    "71926745295458310110936003684728267839",
                    "202623809588942826346262741946261422230",
                    "157606679874949945952002169166156947090"
                ],
                "threshold": 0.9
            },
            "signature_version": "v1",
            "deprecated": false,
            "signature_type": "Line"
        },
        {
            "id": "CVE-2024-26939-9b482b28",
            "target": {
                "file": "drivers/gpu/drm/i915/i915_vma.c",
                "function": "__i915_vma_retire"
            },
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e45882ca829b26b915162e8e86dbb1095768e9e",
            "digest": {
                "function_hash": "198116239689472689870110612360515563622",
                "length": 77.0
            },
            "signature_version": "v1",
            "deprecated": false,
            "signature_type": "Function"
        },
        {
            "id": "CVE-2024-26939-b85a2262",
            "target": {
                "file": "drivers/gpu/drm/i915/i915_vma.c",
                "function": "__i915_vma_active"
            },
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59b2626dd8c8a2e13f18054b3530e0c00073d79f",
            "digest": {
                "function_hash": "89560938694253181711420031141589015256",
                "length": 99.0
            },
            "signature_version": "v1",
            "deprecated": false,
            "signature_type": "Function"
        },
        {
            "id": "CVE-2024-26939-f6e47f3e",
            "target": {
                "file": "drivers/gpu/drm/i915/i915_vma.c"
            },
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e3eb862df9f972ab677fb19e0d4b9b1be8db7b5",
            "digest": {
                "line_hashes": [
                    "322604044336653982202017686199918048098",
                    "300137707729809220316733365765524618785",
                    "240330141114133013588888954296764826645",
                    "336642334898746862503130592689555924416",
                    "60132162329688841623412447925100748135",
                    "217834674303448268222703517044703796152",
                    "186287207532467454219561263482232511091",
                    "137916975552898574280621970850329550186",
                    "338587277248999277307610604428725413844",
                    "68970407636380108871486283286117209815",
                    "327883688917683117097284843168737004808",
                    "334281989537842587928428500591302542081",
                    "230404054079661512459666037492691137028",
                    "187238178062490812549752127103181119610",
                    "132626951892688290940544422599506957720",
                    "79888908614094935648410573964520455132",
                    "4635320868242384571397598785693190431",
                    "162872386890702880971282480026340659491",
                    "5361507596542638440493847028873541192",
                    "155438112205466396553890202782751396277",
                    "197040830202348665063194246961864293817",
                    "174744495181794359953631575309273019370",
                    "335596652378216355172435799255346459427",
                    "71926745295458310110936003684728267839",
                    "202623809588942826346262741946261422230",
                    "157606679874949945952002169166156947090"
                ],
                "threshold": 0.9
            },
            "signature_version": "v1",
            "deprecated": false,
            "signature_type": "Line"
        },
        {
            "id": "CVE-2024-26939-fe693246",
            "target": {
                "file": "drivers/gpu/drm/i915/i915_vma.c",
                "function": "i915_vma_pin_ww"
            },
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@704edc9252f4988ae1ad7dafa23d0db8d90d7190",
            "digest": {
                "function_hash": "202126022313933825269616147788782773686",
                "length": 2955.0
            },
            "signature_version": "v1",
            "deprecated": false,
            "signature_type": "Function"
        }
    ]
}

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.19.0
Fixed
6.1.88
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.29
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.8.3