drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.157, 6.12.110, 6.18.51, 7.2.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE A successful OP_UNMAP_SPARSE marks its region dirty with nouveau_uvma_region_dirty() and defers the teardown to nouveau_uvmm_bind_job_cleanup(); it does not remove the region from uvmm->region_mt. If a later op in the job fails, the unwind path never clears reg->dirty (set in one place, cleared nowhere) and sets op->reg = NULL, so cleanup skips the teardown. The region is left in the tree with dirty set and its completion never signalled. Later binds over that range then fail permanently -- -ENOENT or -EINVAL from the dirty checks, or an unkillable wait_for_completion() in bind_validate_region() -- for the lifetime of the uvmm. Clear reg->dirty when the unwind reverts the sparse unmap, restoring the region to the state it was found in.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From b88baab828713ce0b49b185444b2ee83bed373a8 · fixed in a129b2b875c148aba233ace8447a0c36ca3bae07; From b88baab828713ce0b49b185444b2ee83bed373a8 · fixed in 196ce9e5e93202da097062be24e404984dbc5ac2; From b88baab828713ce0b49b185444b2ee83bed373a8 · fixed in 1101cbfe7f342e5eaaf7444965d4f1215abdac4c; From b88baab828713ce0b49b185444b2ee83bed373a8 · fixed in c60033c172420179b7bbb3d1f843f8dc90164dc5; From b88baab828713ce0b49b185444b2ee83bed373a8 · fixed in 38a62306c4266bcb3cd89e33c7111ee33096ebb3
- Linux Linux
6.6
- KernelLinux
From 6.6.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.51; From 6.19.0 · fixed in 7.2.5