In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/nouveau\/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM<\/p>\n
nouveau_uvmm_sm() calls op_map(), which passes bo->resource through
\nnouveau_mem() to nouveau_uvma_map(). nouveau_uvmm_vmm_map() then reads
\nmem->mem.type.<\/p>\n
But this is only valid when bo->resource is backed by struct nouveau_mem,
\nas is the case for VRAM and TT resources. If the BO is left in
\nTTM_PL_SYSTEM, bo->resource is only a struct ttm_resource. Treating it
\nas struct nouveau_mem makes the mem->mem.type read past the end of the
\nresource, causing a KASAN: slab-use-after-free Read in nouveau_uvmm_sm
\nreport:<\/p>\n
BUG: KASAN: slab-use-after-free in nouveau_uvmm_vmm_map drivers\/gpu\/drm\/nouveau\/nouveau_uvmm.c:152 [inline]
\nBUG: KASAN: slab-use-after-free in nouveau_uvma_map drivers\/gpu\/drm\/nouveau\/nouveau_uvmm.c:199 [inline]
\nBUG: KASAN: slab-use-after-free in op_map drivers\/gpu\/drm\/nouveau\/nouveau_uvmm.c:849 [inline]
\nBUG: KASAN: slab-use-after-free in nouveau_uvmm_sm.constprop.0+0x6ab\/0x900 drivers\/gpu\/drm\/nouveau\/nouveau_uvmm.c:903
\nRead of size 1 at addr ffff888127d3e3a0 by task kworker\/0:1\/11<\/p>\n
CPU: 0 UID: 0 PID: 11 Comm: kworker\/0:1 Not tainted 7.2.0 #5 PREEMPT(lazy)
\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04\/01\/2014
\nWorkqueue: nouveau_sched_wq_2224 drm_sched_run_job_work
\nCall Trace:<\/p>\n
__dump_stack lib\/dump_stack.c:94 [inline]
\n dump_stack_lvl+0x95\/0xe0 lib\/dump_stack.c:120
\n print_address_description mm\/kasan\/report.c:378 [inline]
\n print_report+0xcb\/0x5a0 mm\/kasan\/report.c:482
\n kasan_report+0xca\/0x100 mm\/kasan\/report.c:595
\n nouveau_uvmm_vmm_map drivers\/gpu\/drm\/nouveau\/nouveau_uvmm.c:152 [inline]
\n nouveau_uvma_map drivers\/gpu\/drm\/nouveau\/nouveau_uvmm.c:199 [inline]
\n op_map drivers\/gpu\/drm\/nouveau\/nouveau_uvmm.c:849 [inline]
\n nouveau_uvmm_sm.constprop.0+0x6ab\/0x900 drivers\/gpu\/drm\/nouveau\/nouveau_uvmm.c:903
\n nouveau_uvmm_sm_unmap drivers\/gpu\/drm\/nouveau\/nouveau_uvmm.c:932 [inline]
\n nouveau_uvmm_bind_job_run+0xd6\/0x250 drivers\/gpu\/drm\/nouveau\/nouveau_uvmm.c:1532
\n nouveau_job_run drivers\/gpu\/drm\/nouveau\/nouveau_sched.c:350 [inline]
\n nouveau_sched_run_job+0x62\/0xd0 drivers\/gpu\/drm\/nouveau\/nouveau_sched.c:364
\n drm_sched_run_job_work+0x356\/0xa10 drivers\/gpu\/drm\/scheduler\/sched_main.c:1061
\n process_one_work+0x8a5\/0x1900 kernel\/workqueue.c:3322
\n process_scheduled_works kernel\/workqueue.c:3405 [inline]
\n worker_thread+0x5dd\/0xd80 kernel\/workqueue.c:3486
\n kthread+0x31d\/0x420 kernel\/kthread.c:436
\n ret_from_fork+0x662\/0x940 arch\/x86\/kernel\/process.c:158
\n ret_from_fork_asm+0x1a\/0x30 arch\/x86\/entry\/entry_64.S:245<\/p>\n
Allocated by task 2224 on cpu 0 at 66.550027s:
\n kasan_save_stack+0x24\/0x50 mm\/kasan\/common.c:57
\n kasan_save_track+0x17\/0x60 mm\/kasan\/common.c:78
\n poison_kmalloc_redzone mm\/kasan\/common.c:398 [inline]
\n __kasan_kmalloc+0xaa\/0xb0 mm\/kasan\/common.c:415
\n kasan_kmalloc include\/linux\/kasan.h:263 [inline]
\n __do_kmalloc_node mm\/slub.c:5334 [inline]
\n __kmalloc_noprof+0x304\/0x7c0 mm\/slub.c:5359
\n _kmalloc_noprof include\/linux\/slab.h:992 [inline]
\n dma_resv_list_alloc+0x27\/0x90 drivers\/dma-buf\/dma-resv.c:106
\n dma_resv_reserve_fences+0x60e\/0xa30 drivers\/dma-buf\/dma-resv.c:205
\n ttm_bo_alloc_resource+0x12c\/0xbd0 drivers\/gpu\/drm\/ttm\/ttm_bo.c:721
\n ttm_bo_validate+0x1bc\/0x4a0 drivers\/gpu\/drm\/ttm\/ttm_bo.c:856
\n ttm_bo_init_reserved+0x2c3\/0x570 drivers\/gpu\/drm\/ttm\/ttm_bo.c:970
\n nouveau_bo_init+0x159\/0x2c0 drivers\/gpu\/drm\/nouveau\/nouveau_bo.c:359
\n nouveau_gem_new+0x234\/0x5f0 drivers\/gpu\/drm\/nouveau\/nouveau_gem.c:272
\n nouveau_gem_ioctl_new+0x1eb\/0x420 drivers\/gpu\/drm\/nouveau\/nouveau_gem.c:352
\n drm_ioctl_kernel+0x192\/0x350 drivers\/gpu\/drm\/drm_ioctl.c:817
\n drm_ioctl+0x4f8\/0xb40 drivers\/gpu\/drm\/drm_ioctl.c:914
\n nouveau_drm_ioctl+0xea\/0x2c0 drivers\/gpu\/drm\/nouveau\/nouveau_drm.c:1338
\n vfs_ioctl fs\/ioctl.c:51 [inline]
\n __do_sys_ioctl fs\/ioctl.c:597 [inline]
\n __se_sys_ioctl fs\/ioctl.c:583 [inline]
\n __x64_sys_ioctl+0x180\/0x1d0 fs\/ioctl.c:583
\n do_syscall_x64 ar
\n—truncated—<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/nouveau\/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM<\/p>\n
nouveau_uvmm_sm() calls op_map(), which passes bo->resour<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-40989","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/40989","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40989"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40989"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40989"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}