In the Linux kernel, the following vulnerability has been resolved:
drm/msm/dpu: move dpuencoder's connector assignment to atomicenable()
For cases where the crtc's connectorschanged was set without enable/active getting toggled , there is an atomicenable() call followed by an atomicdisable() but without an atomicmode_set().
This results in a NULL ptr access for the dpuencodergetdrmfmt() call in the atomicenable() as the dpuencoder's connector was cleared in the atomicdisable() but not re-assigned as there was no atomicmode_set() call.
Fix the NULL ptr access by moving the assignment for atomicenable() and also use drmatomicgetnewconnectorforencoder() to get the connector from the atomicstate.
Patchwork: https://patchwork.freedesktop.org/patch/606729/
[
{
"target": {
"function": "dpu_encoder_virt_atomic_mode_set",
"file": "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c"
},
"digest": {
"length": 2691.0,
"function_hash": "125513413742891930830960696205906250370"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3bacf814b6a61cc683c68465f175ebd938f09c52",
"deprecated": false,
"id": "CVE-2024-45015-2a890ef9",
"signature_type": "Function"
},
{
"target": {
"function": "dpu_encoder_virt_atomic_enable",
"file": "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c"
},
"digest": {
"length": 930.0,
"function_hash": "210524170165092851013952477413547929737"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3bacf814b6a61cc683c68465f175ebd938f09c52",
"deprecated": false,
"id": "CVE-2024-45015-7cf3dc10",
"signature_type": "Function"
},
{
"target": {
"function": "dpu_encoder_virt_atomic_mode_set",
"file": "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c"
},
"digest": {
"length": 2691.0,
"function_hash": "125513413742891930830960696205906250370"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aedf02e46eb549dac8db4821a6b9f0c6bf6e3990",
"deprecated": false,
"id": "CVE-2024-45015-88f17be8",
"signature_type": "Function"
},
{
"target": {
"file": "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c"
},
"digest": {
"line_hashes": [
"158206948725444761519682127434571909275",
"155365964925652949565245290433864705702",
"290016829253652650029747920696793721231",
"253354515012741331135698637953720998768",
"127244561230711851236407396991495954432",
"234676626839814206378041087527212242553",
"101703457159224685113550759186409509876"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3bacf814b6a61cc683c68465f175ebd938f09c52",
"deprecated": false,
"id": "CVE-2024-45015-e432933f",
"signature_type": "Line"
},
{
"target": {
"file": "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c"
},
"digest": {
"line_hashes": [
"158206948725444761519682127434571909275",
"155365964925652949565245290433864705702",
"290016829253652650029747920696793721231",
"253354515012741331135698637953720998768",
"127244561230711851236407396991495954432",
"234676626839814206378041087527212242553",
"101703457159224685113550759186409509876"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aedf02e46eb549dac8db4821a6b9f0c6bf6e3990",
"deprecated": false,
"id": "CVE-2024-45015-ef72cf3d",
"signature_type": "Line"
},
{
"target": {
"function": "dpu_encoder_virt_atomic_enable",
"file": "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c"
},
"digest": {
"length": 930.0,
"function_hash": "210524170165092851013952477413547929737"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aedf02e46eb549dac8db4821a6b9f0c6bf6e3990",
"deprecated": false,
"id": "CVE-2024-45015-f3af1878",
"signature_type": "Function"
}
]