dma-fence: Make dma_fence_dedup_array() robust against 0-count input
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.18.40, 7.1.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: dma-fence: Make dma_fence_dedup_array() robust against 0-count input dma_fence_dedup_array() returns 1 when called with num_fences == 0: the for-loop body never executes, j stays at 0, and the final `return ++j` yields 1. This contradicts both the kernel-doc ("Return: Number of unique fences remaining in the array") and the natural expectation that 0 input gives 0 output. The caller __dma_fence_unwrap_merge() bails out via the `if (count == 0 || count == 1)` fast path and so is save. But amdgpu_userq_wait_*() could reach the dedup call with a zero local count and dereference an uninitialized fence slot in the array. Make the contract match the documentation by returning 0 early. This also skips an unnecessary sort() call on an empty array.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From 575ec9b0c2f11f40535ea737ed5a64792780d1ef · fixed in 7aa8f3dba53422465dbe1be8dbb7240304462bb2; From 575ec9b0c2f11f40535ea737ed5a64792780d1ef · fixed in e2d9a2ea178a5da0b4a6693e8ebca5c7fc4d7051; From 575ec9b0c2f11f40535ea737ed5a64792780d1ef · fixed in 77a9298741f8f9e8b963c977f5582ab21c6d3427
- Linux Linux
6.16
- KernelLinux
From 6.16.0 · fixed in 6.18.40; From 6.19.0 · fixed in 7.1.5