drm/i915/active: Fix misuse of non-idle barriers as fence trackers
In the Linux kernel, the following vulnerability has been resolved: drm/i915/active: Fix misuse of non-idle barriers as fence trackers Users reported oopses on list corruptions when using i915 perf with a number of concurrently running graphics applications. Root cause analysis pointed at an issue in barrier processing code -- a race among perf open / close replacing active barriers with perf requests on kernel context and concurrent barrier preallocate / acquire operations performed during user context first pin / last unpin. When adding a request to a composite tracker, we try to reuse an existing fence tracker, already allocated and registered with that composite. The tracker we obtain may already track another fence, may be an idle barrier, or an active barrier. If the tracker we get occurs a non-idle barrier then we try to delete that barrier from a list of barrier tasks it belongs to. However, while doing that we don't respect return value from a function that performs the barrier deletion. Should the deletion ever fail, we would end up reusing the tracker still registered as a barrier task. Since the same structure field is reused with both fence callback lists and barrier tasks list, list corruptions would likely occur. Barriers are now deleted from a barrier tasks list by temporarily removing the list content, traversing that content with skip over the node to be deleted, then populating the list back with the modified content. Should that intentionally racy concurre
CVE-2023-53087
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2023-53087
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "311770173fac27845a3a83e2c16100a54d308f72",
"lessThan": "5e784a7d07af42057c0576fb647b482f4cb0dc2c",
"versionType": "git"
},
{
"status": "affected",
"version": "311770173fac27845a3a83e2c16100a54d308f72",
"lessThan": "6ab7d33617559cced63d467928f478ea5c459021",
"versionType": "git"
},
{
"status": "affected",
"version": "311770173fac27845a3a83e2c16100a54d308f72",
"lessThan": "5c7591b8574c52c56b3994c2fbef1a3a311b5715",
"versionType": "git"
},
{
"status": "affected",
"version": "311770173fac27845a3a83e2c16100a54d308f72",
"lessThan": "9159db27fb19bbf1c91b5c9d5285e66cc96cc5ff",
"versionType": "git"
},
{
"status": "affected",
"version": "311770173fac27845a3a83e2c16100a54d308f72",
"lessThan": "e0e6b416b25ee14716f3549e0cbec1011b193809",
"versionType": "git"
}
],
"programFiles": [
"drivers/gpu/drm/i915/i915_active.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.5",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.176",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.104",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.21",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.2.8",
"versionType": "semver",
"lessThanOrEqual": "6.2.*"
},
{
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/gpu/drm/i915/i915_active.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2023-53087
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #30252 · Revision 1
- Added to Heist Feed
- Publisher date