In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/amd\/display: guard dc_sink dereferences in MST mode validation<\/p>\n
dm_dp_mst_is_port_support_mode() reads
\naconnector->dc_sink->dsc_caps… for the DSC branch-throughput check,
\nand get_conv_frl_bw()’s HDMI-PCON FRL-bandwidth path reads
\naconnector->dc_sink->edid_caps.max_frl_rate, both without a NULL
\ncheck. dc_sink is cleared asynchronously on MST unplug, and both
\nfunctions run from paths that the driver’s own comments document as
\nracing that teardown: the connector probe worker’s ->mode_valid
\ncallback and a compositor’s atomic check, neither of which holds the
\nMST manager lock that the teardown path uses. The former does have an
\nexisting dsc_aux NULL check, but dsc_aux isn’t reliably cleared in
\nevery path that clears dc_sink, so it doesn’t cover this.<\/p>\n
Fail the port-support check and skip the FRL conversion path when the
\nsink is already gone.<\/p>\n
(cherry picked from commit 7c3db8da4e039698ae198c870712428644e965c7)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/amd\/display: guard dc_sink dereferences in MST mode validation<\/p>\n
dm_dp_mst_is_port_support_mode() reads
\naconnector->dc_sink->dsc<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41258","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41258","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41258"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41258"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41258"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}