In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds<\/p>\n
Reading \/sys\/kernel\/debug\/kfd\/mqds while a process holds an active KFD
\nqueue triggers a NULL pointer dereference because the for loop that
\ncalls mqd_mgr->debugfs_show_mqd() is incorrectly placed outside the
\nif (pqn->q) block that initializes mqd_mgr.<\/p>\n
The queue list can contain entries where pqn->q is NULL (kernel queues
\nwhere only pqn->kq is valid). In the original code:<\/p>\n
if (pqn->q) {
\n …
\n mqd_mgr = q->device->dqm->mqd_mgrs[mqd_type];
\n size = mqd_mgr->mqd_stride(…);
\n }<\/p>\n
for (xcc = 0; xcc mqd + size * xcc;
\n r = mqd_mgr->debugfs_show_mqd(m, mqd);
\n }<\/p>\n
When iterating over a queue node where pqn->q is NULL:
\n1. The if (pqn->q) block is skipped
\n2. mqd_mgr remains uninitialized (NULL from declaration)
\n3. The for loop executes anyway
\n4. mqd_mgr->debugfs_show_mqd(m, mqd) dereferences NULL<\/p>\n
The crash manifests as:<\/p>\n
BUG: kernel NULL pointer dereference, address: 0000000000000000
\n #PF: supervisor instruction fetch in kernel mode
\n RIP: 0010:0x0
\n Call Trace:
\n pqm_debugfs_mqds+0x10c\/0x1d0 [amdgpu]
\n kfd_debugfs_mqds_by_process+0x9b\/0x110 [amdgpu]
\n seq_read_iter+0x132\/0x4b0
\n …<\/p>\n
Fix by moving the for loop inside the if (pqn->q) block, so mqd_mgr
\nand related variables are only used when properly initialized.<\/p>\n
(cherry picked from commit 8bfe29d5c798940f797aa24135d2734c3ffce9de)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds<\/p>\n
Reading \/sys\/kernel\/debug\/kfd\/mqds while a process holds an activ<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24496","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24496","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24496"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24496"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24496"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}