Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't access invalid sched Since 2320c9e6a768 ("drm/sched: memset() 'job' in drm_sched_job_init()") accessing job->base.sched can produce unexpected results as the initialisation of (*job)->base.sched done in amdgpu_job_alloc is overwritten by the memset. This commit fixes an issue when a CS would fail validation and would be rejected after job->num_ibs is incremented. In this case, amdgpu_ib_free(ring->adev, ...) will be called, which would crash the machine because the ring value is bogus. To fix this, pass a NULL pointer to amdgpu_ib_free(): we can do this because the device is actually not used in this function. The next commit will remove the ring argument completely. (cherry picked from commit 2ae520cb12831d264ceb97c61f72c59d33c0dbd7)
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
166df51487f46b6e997dfeea7ca0c2a970853f07 to < 65501a4fd84ecdc0af863dbb37759242aab9f2ddaffected87210234e5a273ebf9c4110a6aa82b8221478daa to < da6b2c626ae73c303378ce9eaf6e3eaf16c9925aaffected2da108b4b5fb7ec04d7e951418ed80e97f7c35ad to < 67291d601f2b032062b1b2f60ffef1b63e10094caffected2320c9e6a768d135c7b0039995182bb1a4e4fd22 to < a93b1020eb9386d7da11608477121b10079c076aaffected
Linux Linux
Default version status: unaffected
6.1.120 to < 6.1.122affected6.6.66 to < 6.6.68affected6.12.5 to < 6.12.7affected
References
- https://git.kernel.org/stable/c/65501a4fd84ecdc0af863dbb37759242aab9f2dd ↗
- https://git.kernel.org/stable/c/da6b2c626ae73c303378ce9eaf6e3eaf16c9925a ↗
- https://git.kernel.org/stable/c/67291d601f2b032062b1b2f60ffef1b63e10094c ↗
- https://git.kernel.org/stable/c/a93b1020eb9386d7da11608477121b10079c076a ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html ↗