ACK: [SRU][J][PATCH 0/1] CVE-2022-49359

[Andrei Gherzan]

On 26/09/08 11:50PM, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2022-49359
> 
> [ Impact ]
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> drm/panfrost: Job should reference MMU not file_priv
> 
> For a while now it's been allowed for a MMU context to outlive it's
> corresponding panfrost_priv, however the job structure still references
> panfrost_priv to get hold of the MMU context. If panfrost_priv has been freed
> this is a use-after-free which I've been able to trigger resulting in a splat.
> 
> To fix this, drop the reference to panfrost_priv in the job structure and add a
> direct reference to the MMU structure which is what's actually needed.
> 
> [ Fix ]
> 
> jammy/linux: backported from 6e516faf0431
> 
> The upstream fix removes the file_priv reference from the panfrost job
> structure and instead holds a direct reference to the MMU context, which is
> what the job actually needs. In this tree the scheduler entity lookup happens
> inside panfrost_job_push() (job.c) via job->file_priv->sched_entity rather
> than in the submit ioctl, so instead of applying upstream's drm_sched_job_init
> block in drv.c, file_priv is passed into panfrost_job_push() (updating its
> declaration in job.h and the caller in drv.c) and the sched_entity is taken
> from that parameter, keeping the job structure free of file_priv.
> 
> [ Test Plan ]
> 
> Build and boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A bad fix here would affect systems that use the Panfrost driver to drive Arm
> Mali GPUs (such as many Arm-based single-board computers and Chromebooks),
> where a regression could show up as GPU rendering failures, MMU context
> mismatches, or crashes when GPU jobs are submitted and their owning file
> handle is closed. Systems without a Mali GPU or that do not load the Panfrost
> driver are not affected.
> 
> [ Other Info ]
> 
> Kybele flow-v11-21-g0f091652. Reference: d25cd68a/v1

Acked-by: Andrei Gherzan <andrei.gherzan at canonical.com>

-- 
Andrei Gherzan
gpg: rsa4096/D4D94F67AD0E9640
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260911/f461a4e6/attachment.sig>