Description
In the Linux kernel, the following vulnerability has been resolved: cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_qos_update_request() that indirectly accesses the policy object in question through the QoS request object passed to it. Fortunately, update_qos_request() is called under intel_pstate_driver_lock, so this issue does not matter for changing the intel_pstate operation mode, but it theoretically can cause a crash to occur on CPU device hot removal (which currently can only happen in virt, but it is formally supported nevertheless). Address this issue by modifying update_qos_request() to drop the reference to the policy later.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
da5c504c7aae96db68c4b38e2564a88e91842d89 to < 15ac9579ebdaf22a37d7f60b3a8efc1029732ef9affectedda5c504c7aae96db68c4b38e2564a88e91842d89 to < bc26564bcc659beb6d977cd6eb394041ec2f2851affectedda5c504c7aae96db68c4b38e2564a88e91842d89 to < ad4e8f9bdbef11a19b7cb93e7f313bf59bdcc3b4affectedda5c504c7aae96db68c4b38e2564a88e91842d89 to < 0a58d3e77b22b087a57831c87cafd360e144a5bdaffectedda5c504c7aae96db68c4b38e2564a88e91842d89 to < 69a18ff6c60e8e113420f15355fad862cb45d38eaffectedda5c504c7aae96db68c4b38e2564a88e91842d89 to < ba63d4e9857a72a89e71a4eff9f2cc8c283e94c3affectedda5c504c7aae96db68c4b38e2564a88e91842d89 to < 57e4a6aadf12578b96a038373cffd54b3a58b092affectedda5c504c7aae96db68c4b38e2564a88e91842d89 to < 69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467affected
Linux Linux
Default version status: affected
5.4affected0 to < 5.4unaffected5.4.301 to ≤ 5.4.*unaffected5.10.246 to ≤ 5.10.*unaffected5.15.195 to ≤ 5.15.*unaffected6.1.157 to ≤ 6.1.*unaffected6.6.113 to ≤ 6.6.*unaffected6.12.54 to ≤ 6.12.*unaffected6.17.4 to ≤ 6.17.*unaffected6.18 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/15ac9579ebdaf22a37d7f60b3a8efc1029732ef9 ↗
- https://git.kernel.org/stable/c/bc26564bcc659beb6d977cd6eb394041ec2f2851 ↗
- https://git.kernel.org/stable/c/ad4e8f9bdbef11a19b7cb93e7f313bf59bdcc3b4 ↗
- https://git.kernel.org/stable/c/0a58d3e77b22b087a57831c87cafd360e144a5bd ↗
- https://git.kernel.org/stable/c/69a18ff6c60e8e113420f15355fad862cb45d38e ↗
- https://git.kernel.org/stable/c/ba63d4e9857a72a89e71a4eff9f2cc8c283e94c3 ↗
- https://git.kernel.org/stable/c/57e4a6aadf12578b96a038373cffd54b3a58b092 ↗
- https://git.kernel.org/stable/c/69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467 ↗