Skip to content
Heist/ feed
High

drm/i915/active: Fix misuse of non-idle barriers as fence trackers

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: drm/i915/active: Fix misuse of non-idle barriers as fence trackers Users reported oopses on list corruptions when using i915 perf with a number of concurrently running graphics applications. Root cause analysis pointed at an issue in barrier processing code -- a race among perf open / close replacing active barriers with perf requests on kernel context and concurrent barrier preallocate / acquire operations performed during user context first pin / last unpin. When adding a request to a composite tracker, we try to reuse an existing fence tracker, already allocated and registered with that composite. The tracker we obtain may already track another fence, may be an idle barrier, or an active barrier. If the tracker we get occurs a non-idle barrier then we try to delete that barrier from a list of barrier tasks it belongs to. However, while doing that we don't respect return value from a function that performs the barrier deletion. Should the deletion ever fail, we would end up reusing the tracker still registered as a barrier task. Since the same structure field is reused with both fence callback lists and barrier tasks list, list corruptions would likely occur. Barriers are now deleted from a barrier tasks list by temporarily removing the list content, traversing that content with skip over the node to be deleted, then populating the list back with the modified content. Should that intentionally racy concurre

Announced Source revision 1
Original source ↗

CVE-2023-53087

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2023-53087

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "311770173fac27845a3a83e2c16100a54d308f72",
        "lessThan": "5e784a7d07af42057c0576fb647b482f4cb0dc2c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "311770173fac27845a3a83e2c16100a54d308f72",
        "lessThan": "6ab7d33617559cced63d467928f478ea5c459021",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "311770173fac27845a3a83e2c16100a54d308f72",
        "lessThan": "5c7591b8574c52c56b3994c2fbef1a3a311b5715",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "311770173fac27845a3a83e2c16100a54d308f72",
        "lessThan": "9159db27fb19bbf1c91b5c9d5285e66cc96cc5ff",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "311770173fac27845a3a83e2c16100a54d308f72",
        "lessThan": "e0e6b416b25ee14716f3549e0cbec1011b193809",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/gpu/drm/i915/i915_active.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.5"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.5",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.176",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.104",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.21",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.2.8",
        "versionType": "semver",
        "lessThanOrEqual": "6.2.*"
      },
      {
        "status": "unaffected",
        "version": "6.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/gpu/drm/i915/i915_active.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2023-53087

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#30252 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement