In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/nouveau\/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op<\/p>\n
Each bind_job_op is zeroed by kzalloc_obj() in bind_job_op_from_uop(),
\nand the OP_MAP_SPARSE case in nouveau_uvmm_bind_job_submit() only creates
\na region, so op->ops stays NULL for a successfully processed sparse map.<\/p>\n
If a later op in the same job fails, the reverse unwind loop revisits that
\nop and calls drm_gpuva_ops_free(&uvmm->base, op->ops) unconditionally.
\ndrm_gpuva_ops_free() dereferences its argument right away
\n(list_for_each_entry_safe on &ops->list), so a NULL op->ops oopses. The
\npath is reachable by any render-node fd holder, since NOUVEAU_VM_BIND is
\nDRM_RENDER_ALLOW.<\/p>\n
Guard the free with IS_ERR_OR_NULL(), as nouveau_uvmm_bind_job_cleanup()
\nalready does for the identical free.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/nouveau\/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op<\/p>\n
Each bind_job_op is zeroed by kzalloc_obj() in bind_job_op_from_uop<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24489","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24489","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24489"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24489"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24489"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}