In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Fix a deadlock in dma buf fence polling
Introduce a version of the fence ops that on release doesn't remove the fence from the pending list, and thus doesn't require a lock to fix poll->fence wait->fence unref deadlocks.
vmwgfx overwrites the wait callback to iterate over the list of all fences and update their status, to do that it holds a lock to prevent the list modifcations from other threads. The fence destroy callback both deletes the fence and removes it from the list of pending fences, for which it holds a lock.
dma buf polling cb unrefs a fence after it's been signaled: so the poll calls the wait, which signals the fences, which are being destroyed. The destruction tries to acquire the lock on the pending fences list which it can never get because it's held by the wait from which it was called.
Old bug, but not a lot of userspace apps were using dma-buf polling interfaces. Fix those, in particular this fixes KDE stalls/deadlock.
[
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 539.0,
"function_hash": "41425080173075626675094946884441899036"
},
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_fence_obj_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9e20d028d8d1deb1e7fed18f22ffc01669cf3237",
"signature_version": "v1",
"id": "CVE-2024-43863-035df9f5"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 539.0,
"function_hash": "41425080173075626675094946884441899036"
},
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_fence_obj_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c98ab18b9f315ff977c2c65d7c71298ef98be8e3",
"signature_version": "v1",
"id": "CVE-2024-43863-09564da5"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 500.0,
"function_hash": "84017929271700808465938403571851585394"
},
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_fence_goal_new_locked"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c98ab18b9f315ff977c2c65d7c71298ef98be8e3",
"signature_version": "v1",
"id": "CVE-2024-43863-17f6da7d"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 539.0,
"function_hash": "41425080173075626675094946884441899036"
},
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_fence_obj_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b933b16c996af8adb6bc1b5748a63dfb41a82bc",
"signature_version": "v1",
"id": "CVE-2024-43863-1d0d6236"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 500.0,
"function_hash": "84017929271700808465938403571851585394"
},
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_fence_goal_new_locked"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9e20d028d8d1deb1e7fed18f22ffc01669cf3237",
"signature_version": "v1",
"id": "CVE-2024-43863-2fadd453"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"177185194107905672884663659978221697046",
"144490088579836331676526592369640705942",
"63754826458009805431868222586408706660",
"115502126244548933097813635407539913845",
"295805770753684846593500499140694623883",
"12303339787903046630421583088930987961",
"254678867670572679586962737638788177168",
"102125975598336742536489767846747064804",
"93174428344336867842118341383172230597",
"104408877341128249454965457430566906317",
"258720084706223104331153306341566682922",
"71850226901781820915292206544268361169",
"121070142005705588291422543238299263103",
"238366171493917523037776058348871210272",
"41235228001324762153373245054539561782",
"272662360274704795439110177815760638433",
"246381082003511862229017242040725081735",
"329372180693822529213965108089342679284",
"243268705293153443138677771040569398930",
"215290507573822821014283525913051152714",
"239469606181180652861410120075594851905",
"61443471563985619066073590658019246278",
"83575739283341832521606381933711176169",
"151278140884590673366098833165716781991",
"138778214207812910683093139317265735665",
"143341993325180731486716168487182174232",
"5291390003054616900336895370419395516"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b933b16c996af8adb6bc1b5748a63dfb41a82bc",
"signature_version": "v1",
"id": "CVE-2024-43863-3c66bfdf"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 539.0,
"function_hash": "41425080173075626675094946884441899036"
},
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_fence_obj_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8943969f9ead2fd3044fc826140a21622ef830e",
"signature_version": "v1",
"id": "CVE-2024-43863-510684f2"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 539.0,
"function_hash": "41425080173075626675094946884441899036"
},
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_fence_obj_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e58337100721f3cc0c7424a18730e4f39844934f",
"signature_version": "v1",
"id": "CVE-2024-43863-5593f471"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 312.0,
"function_hash": "157553384191141077050269238601241953733"
},
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_fence_obj_destroy"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c98ab18b9f315ff977c2c65d7c71298ef98be8e3",
"signature_version": "v1",
"id": "CVE-2024-43863-58a512ac"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"177185194107905672884663659978221697046",
"144490088579836331676526592369640705942",
"63754826458009805431868222586408706660",
"115502126244548933097813635407539913845",
"295805770753684846593500499140694623883",
"12303339787903046630421583088930987961",
"254678867670572679586962737638788177168",
"102125975598336742536489767846747064804",
"93174428344336867842118341383172230597",
"104408877341128249454965457430566906317",
"258720084706223104331153306341566682922",
"71850226901781820915292206544268361169",
"121070142005705588291422543238299263103",
"238366171493917523037776058348871210272",
"41235228001324762153373245054539561782",
"272662360274704795439110177815760638433",
"246381082003511862229017242040725081735",
"329372180693822529213965108089342679284",
"243268705293153443138677771040569398930",
"215290507573822821014283525913051152714",
"239469606181180652861410120075594851905",
"61443471563985619066073590658019246278",
"83575739283341832521606381933711176169",
"151278140884590673366098833165716781991",
"138778214207812910683093139317265735665",
"143341993325180731486716168487182174232",
"5291390003054616900336895370419395516"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c98ab18b9f315ff977c2c65d7c71298ef98be8e3",
"signature_version": "v1",
"id": "CVE-2024-43863-72c56cea"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 312.0,
"function_hash": "157553384191141077050269238601241953733"
},
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_fence_obj_destroy"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9e20d028d8d1deb1e7fed18f22ffc01669cf3237",
"signature_version": "v1",
"id": "CVE-2024-43863-7c6aeba4"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 312.0,
"function_hash": "157553384191141077050269238601241953733"
},
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_fence_obj_destroy"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8943969f9ead2fd3044fc826140a21622ef830e",
"signature_version": "v1",
"id": "CVE-2024-43863-81a34c65"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 500.0,
"function_hash": "84017929271700808465938403571851585394"
},
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_fence_goal_new_locked"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8943969f9ead2fd3044fc826140a21622ef830e",
"signature_version": "v1",
"id": "CVE-2024-43863-92167162"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"177185194107905672884663659978221697046",
"144490088579836331676526592369640705942",
"63754826458009805431868222586408706660",
"115502126244548933097813635407539913845",
"295805770753684846593500499140694623883",
"12303339787903046630421583088930987961",
"254678867670572679586962737638788177168",
"102125975598336742536489767846747064804",
"93174428344336867842118341383172230597",
"104408877341128249454965457430566906317",
"258720084706223104331153306341566682922",
"71850226901781820915292206544268361169",
"121070142005705588291422543238299263103",
"238366171493917523037776058348871210272",
"41235228001324762153373245054539561782",
"272662360274704795439110177815760638433",
"246381082003511862229017242040725081735",
"329372180693822529213965108089342679284",
"243268705293153443138677771040569398930",
"215290507573822821014283525913051152714",
"239469606181180652861410120075594851905",
"61443471563985619066073590658019246278",
"83575739283341832521606381933711176169",
"151278140884590673366098833165716781991",
"138778214207812910683093139317265735665",
"143341993325180731486716168487182174232",
"5291390003054616900336895370419395516"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9e20d028d8d1deb1e7fed18f22ffc01669cf3237",
"signature_version": "v1",
"id": "CVE-2024-43863-970d938b"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 500.0,
"function_hash": "84017929271700808465938403571851585394"
},
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_fence_goal_new_locked"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b933b16c996af8adb6bc1b5748a63dfb41a82bc",
"signature_version": "v1",
"id": "CVE-2024-43863-a842b2b2"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"177185194107905672884663659978221697046",
"144490088579836331676526592369640705942",
"63754826458009805431868222586408706660",
"115502126244548933097813635407539913845",
"295805770753684846593500499140694623883",
"12303339787903046630421583088930987961",
"254678867670572679586962737638788177168",
"102125975598336742536489767846747064804",
"93174428344336867842118341383172230597",
"104408877341128249454965457430566906317",
"258720084706223104331153306341566682922",
"71850226901781820915292206544268361169",
"121070142005705588291422543238299263103",
"238366171493917523037776058348871210272",
"41235228001324762153373245054539561782",
"272662360274704795439110177815760638433",
"246381082003511862229017242040725081735",
"329372180693822529213965108089342679284",
"243268705293153443138677771040569398930",
"215290507573822821014283525913051152714",
"239469606181180652861410120075594851905",
"61443471563985619066073590658019246278",
"83575739283341832521606381933711176169",
"151278140884590673366098833165716781991",
"138778214207812910683093139317265735665",
"143341993325180731486716168487182174232",
"5291390003054616900336895370419395516"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e58337100721f3cc0c7424a18730e4f39844934f",
"signature_version": "v1",
"id": "CVE-2024-43863-af960e55"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 312.0,
"function_hash": "157553384191141077050269238601241953733"
},
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_fence_obj_destroy"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e58337100721f3cc0c7424a18730e4f39844934f",
"signature_version": "v1",
"id": "CVE-2024-43863-c6609702"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 312.0,
"function_hash": "157553384191141077050269238601241953733"
},
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_fence_obj_destroy"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b933b16c996af8adb6bc1b5748a63dfb41a82bc",
"signature_version": "v1",
"id": "CVE-2024-43863-cdb4a446"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"177185194107905672884663659978221697046",
"144490088579836331676526592369640705942",
"63754826458009805431868222586408706660",
"115502126244548933097813635407539913845",
"295805770753684846593500499140694623883",
"12303339787903046630421583088930987961",
"254678867670572679586962737638788177168",
"102125975598336742536489767846747064804",
"93174428344336867842118341383172230597",
"104408877341128249454965457430566906317",
"258720084706223104331153306341566682922",
"71850226901781820915292206544268361169",
"121070142005705588291422543238299263103",
"238366171493917523037776058348871210272",
"41235228001324762153373245054539561782",
"272662360274704795439110177815760638433",
"246381082003511862229017242040725081735",
"329372180693822529213965108089342679284",
"243268705293153443138677771040569398930",
"215290507573822821014283525913051152714",
"239469606181180652861410120075594851905",
"61443471563985619066073590658019246278",
"83575739283341832521606381933711176169",
"151278140884590673366098833165716781991",
"138778214207812910683093139317265735665",
"143341993325180731486716168487182174232",
"5291390003054616900336895370419395516"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8943969f9ead2fd3044fc826140a21622ef830e",
"signature_version": "v1",
"id": "CVE-2024-43863-d094a472"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 500.0,
"function_hash": "84017929271700808465938403571851585394"
},
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_fence_goal_new_locked"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e58337100721f3cc0c7424a18730e4f39844934f",
"signature_version": "v1",
"id": "CVE-2024-43863-d79e13b0"
}
]