In the Linux kernel, the following vulnerability has been resolved:
drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails
Calling a6xxdestroy() before adrenogpu_init() leads to a null pointer dereference on:
msmgpucleanup() : platformsetdrvdata(gpu->pdev, NULL);
as gpu->pdev is only assigned in:
a6xxgpuinit() |_ adrenogpuinit |_ msmgpuinit()
Instead of relying on handwavy null checks down the cleanup chain, explicitly de-allocate the LLC data and free a6xx_gpu instead.
Patchwork: https://patchwork.freedesktop.org/patch/588919/
[
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"235870942015542144516892896042023387835",
"252014107403090732321664659766279994985",
"175197351927993300101585479742075658824",
"246535056599433082839557692262816450687"
]
},
"target": {
"file": "drivers/gpu/drm/msm/adreno/a6xx_gpu.c"
},
"id": "CVE-2024-38390-03c047d8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@247849eeb3fd88f8990ed73e33af70d5c10f9aec",
"signature_type": "Line"
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"151195978522551860234729475716115023955",
"26235712522057535830889706516502009592",
"175197351927993300101585479742075658824",
"106767348093156794044585555905583056155"
]
},
"target": {
"file": "drivers/gpu/drm/msm/adreno/a6xx_gpu.c"
},
"id": "CVE-2024-38390-252a282e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@617e3d1680504a3f9d88e1582892c68be155498f",
"signature_type": "Line"
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "278664855882498658931727816816046607520",
"length": 1655.0
},
"target": {
"function": "a6xx_gpu_init",
"file": "drivers/gpu/drm/msm/adreno/a6xx_gpu.c"
},
"id": "CVE-2024-38390-48219a05",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46d4efcccc688cbacdd70a238bedca510acaa8e4",
"signature_type": "Function"
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "81378253902101115251108939419104778552",
"length": 1262.0
},
"target": {
"function": "a6xx_gpu_init",
"file": "drivers/gpu/drm/msm/adreno/a6xx_gpu.c"
},
"id": "CVE-2024-38390-6cc24a27",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@247849eeb3fd88f8990ed73e33af70d5c10f9aec",
"signature_type": "Function"
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "278664855882498658931727816816046607520",
"length": 1655.0
},
"target": {
"function": "a6xx_gpu_init",
"file": "drivers/gpu/drm/msm/adreno/a6xx_gpu.c"
},
"id": "CVE-2024-38390-917766b7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@617e3d1680504a3f9d88e1582892c68be155498f",
"signature_type": "Function"
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"151195978522551860234729475716115023955",
"26235712522057535830889706516502009592",
"175197351927993300101585479742075658824",
"106767348093156794044585555905583056155"
]
},
"target": {
"file": "drivers/gpu/drm/msm/adreno/a6xx_gpu.c"
},
"id": "CVE-2024-38390-f775f8ab",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46d4efcccc688cbacdd70a238bedca510acaa8e4",
"signature_type": "Line"
}
]