drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.91, 6.18.33, 7.0.10
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() Two error handling issues exist in xe_exec_queue_create_ioctl(): 1. When xe_hw_engine_group_add_exec_queue() fails, the error path jumps to put_exec_queue which skips xe_exec_queue_kill(). If the VM is in preempt fence mode, xe_vm_add_compute_exec_queue() has already added the queue to the VM's compute exec queue list. Skipping the kill leaves the queue on that list, leading to a dangling pointer after the queue is freed. 2. When xa_alloc() fails after xe_hw_engine_group_add_exec_queue() has succeeded, the error path does not call xe_hw_engine_group_del_exec_queue() to remove the queue from the hw engine group list. The queue is then freed while still linked into the hw engine group, causing a use-after-free. Fix both by: • Changing the xe_hw_engine_group_add_exec_queue() failure path to jump to kill_exec_queue so that xe_exec_queue_kill() properly removes the queue from the VM's compute list. • Adding a del_hw_engine_group label before kill_exec_queue for the xa_alloc() failure path, which removes the queue from the hw engine group before proceeding with the rest of the cleanup. (cherry picked from commit 37c831f401746a45d510b312b0ed7a77b1e06ec8)
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From 7970cb36966c9b9183255dc097ae0446300eebcf · fixed in f93b00161213a0fe9f7ff1d8498ee5ca9e0a5c43; From 7970cb36966c9b9183255dc097ae0446300eebcf · fixed in 753b149d5a433eb19e0c1b0eb4526a6e26120d1f; From 7970cb36966c9b9183255dc097ae0446300eebcf · fixed in 1be55646d8a2035343b012dcb12210db7bb8b056; From 7970cb36966c9b9183255dc097ae0446300eebcf · fixed in f3cc22d4df3ed58439ea7e21daa54c3608e03b78
- Linux Linux
6.12
- KernelLinux
From 6.12.0 · fixed in 6.12.91; From 6.13.0 · fixed in 6.18.33; From 6.19.0 · fixed in 7.0.10