[SRU][J][PATCH 0/1] CVE-2022-49359

[Cengiz Can]

https://ubuntu.com/security/CVE-2022-49359

[ Impact ]

In the Linux kernel, the following vulnerability has been resolved:

drm/panfrost: Job should reference MMU not file_priv

For a while now it's been allowed for a MMU context to outlive it's
corresponding panfrost_priv, however the job structure still references
panfrost_priv to get hold of the MMU context. If panfrost_priv has been freed
this is a use-after-free which I've been able to trigger resulting in a splat.

To fix this, drop the reference to panfrost_priv in the job structure and add a
direct reference to the MMU structure which is what's actually needed.

[ Fix ]

jammy/linux: backported from 6e516faf0431

The upstream fix removes the file_priv reference from the panfrost job
structure and instead holds a direct reference to the MMU context, which is
what the job actually needs. In this tree the scheduler entity lookup happens
inside panfrost_job_push() (job.c) via job->file_priv->sched_entity rather
than in the submit ioctl, so instead of applying upstream's drm_sched_job_init
block in drv.c, file_priv is passed into panfrost_job_push() (updating its
declaration in job.h and the caller in drv.c) and the sched_entity is taken
from that parameter, keeping the job structure free of file_priv.

[ Test Plan ]

Build and boot tested.

[ Where Problems Could Occur ]

A bad fix here would affect systems that use the Panfrost driver to drive Arm
Mali GPUs (such as many Arm-based single-board computers and Chromebooks),
where a regression could show up as GPU rendering failures, MMU context
mismatches, or crashes when GPU jobs are submitted and their owning file
handle is closed. Systems without a Mali GPU or that do not load the Panfrost
driver are not affected.

[ Other Info ]

Kybele flow-v11-21-g0f091652. Reference: d25cd68a/v1