drm/amdgpu: fix rmmio iounmap skipped on device removal
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.112, 6.18.54, 7.2.8
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix rmmio iounmap skipped on device removal amdgpu_pci_remove() calls drm_dev_unplug() before fini_sw(), so drm_dev_enter() is already false there and the iounmap() guarded by it is skipped. This .remove path runs on both hot-unplug and plain rmmod, so the register BAR ioremap mapping leaks one instance per unload. Unmap rmmio unconditionally (guard only on non-NULL) and drop the now unused idx. (cherry picked from commit dd6f86a97260e5207d3329ad03aa89fdad61b1e6)
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 62d5f9f7110ad374db67ab4820f4ff2d916c3cdb · fixed in e81502d6791df9ecd003bfb2ca44f0d1f1b38439; From 62d5f9f7110ad374db67ab4820f4ff2d916c3cdb · fixed in cd55dde2b63789a3dafe982c89844f537501d096; From 62d5f9f7110ad374db67ab4820f4ff2d916c3cdb · fixed in a645584c3ccc493ee835f77155829442bd7578c3; From 62d5f9f7110ad374db67ab4820f4ff2d916c3cdb · fixed in 5155002b03b24ba3ef91c5c313b8cf0171b24904
- Linux Linux
5.17
- KernelLinux
From 5.17.0 · fixed in 6.12.112; From 6.13.0 · fixed in 6.18.54; From 6.19.0 · fixed in 7.2.8