In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/nouveau: unsubscribe the channel-kill event before the fence context<\/p>\n
nouveau_channel_del() tears the fence context down first and only drops
\nthe channel-kill subscription later, in the middle of the nvif object
\nteardown:<\/p>\n
\tif (chan->fence)
\n\t\tnouveau_fence(chan->cli->drm)->context_del(chan);
\n\t…
\n\tnvif_object_dtor(&chan->vram);
\n\tnvif_event_dtor(&chan->kill);<\/p>\n
The subscribed handler is nouveau_channel_killed(), which calls
\nnouveau_channel_kill() and from there nouveau_fence_context_kill() on
\nchan->fence. A kill event delivered in that window takes fctx->lock and
\nwalks fctx->pending on a fence context that context_del() has already
\nfreed.<\/p>\n
Nothing reaches this below Fermi today, because the subscription is
\ngated on FERMI_CHANNEL_GPFIFO and nothing kills a channel there. On
\nFermi and newer the window is real but narrow, since a kill has to land
\nexactly while the channel is being destroyed. That is reason enough on
\nits own, which is why this carries a Fixes: tag. The last patch in this
\nseries subscribes Tesla channels as well; nothing kills those today, so
\nit does not widen the exposure now, but it is the groundwork for a
\nrecovery path that would, and the ordering is better fixed before that
\nlands than alongside it.<\/p>\n
Drop the subscription before anything it depends on is torn down.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/nouveau: unsubscribe the channel-kill event before the fence context<\/p>\n
nouveau_channel_del() tears the fence context down first <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24490","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24490","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24490"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24490"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24490"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}