In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/nouveau\/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE<\/p>\n
A successful OP_UNMAP_SPARSE marks its region dirty with
\nnouveau_uvma_region_dirty() and defers the teardown to
\nnouveau_uvmm_bind_job_cleanup(); it does not remove the region from
\nuvmm->region_mt.<\/p>\n
If a later op in the job fails, the unwind path never clears reg->dirty
\n(set in one place, cleared nowhere) and sets op->reg = NULL, so cleanup
\nskips the teardown. The region is left in the tree with dirty set and its
\ncompletion never signalled. Later binds over that range then fail
\npermanently — -ENOENT or -EINVAL from the dirty checks, or an unkillable
\nwait_for_completion() in bind_validate_region() — for the lifetime of
\nthe uvmm.<\/p>\n
Clear reg->dirty when the unwind reverts the sparse unmap, restoring the
\nregion to the state it was found in.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/nouveau\/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE<\/p>\n
A successful OP_UNMAP_SPARSE marks its region dirty with<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24487","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24487","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24487"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24487"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24487"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}