Description
In the Linux kernel, the following vulnerability has been resolved: uacce: ensure safe queue release with state management Directly calling `put_queue` carries risks since it cannot guarantee that resources of `uacce_queue` have been fully released beforehand. So adding a `stop_queue` operation for the UACCE_CMD_PUT_Q command and leaving the `put_queue` operation to the final resource release ensures safety. Queue states are defined as follows: - UACCE_Q_ZOMBIE: Initial state - UACCE_Q_INIT: After opening `uacce` - UACCE_Q_STARTED: After `start` is issued via `ioctl` When executing `poweroff -f` in virt while accelerator are still working, `uacce_fops_release` and `uacce_remove` may execute concurrently. This can cause `uacce_put_queue` within `uacce_fops_release` to access a NULL `ops` pointer. Therefore, add state checks to prevent accessing freed pointers.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
015d239ac0142ad0e26567fd890ef8d171f13709 to < b457abeb5d962db88aaf60e249402fd3073dbfabaffected015d239ac0142ad0e26567fd890ef8d171f13709 to < 8b57bf1d3b1db692f34bce694a03e41be79f6016affected015d239ac0142ad0e26567fd890ef8d171f13709 to < 336fb41a186e7c0415ae94fec9e23d1f04b87483affected015d239ac0142ad0e26567fd890ef8d171f13709 to < 43f233eb6e7b9d88536881a9bc43726d0e34800daffected015d239ac0142ad0e26567fd890ef8d171f13709 to < 47634d70073890c9c37e39ab4ff93d4b585b028aaffected015d239ac0142ad0e26567fd890ef8d171f13709 to < 92e4f11e29b98ef424ff72d6371acac03e5d973caffected015d239ac0142ad0e26567fd890ef8d171f13709 to < 26c08dabe5475d99a13f353d8dd70e518de45663affected
Linux Linux
Default version status: affected
5.7affected0 to < 5.7unaffected5.10.249 to ≤ 5.10.*unaffected5.15.199 to ≤ 5.15.*unaffected6.1.162 to ≤ 6.1.*unaffected6.6.122 to ≤ 6.6.*unaffected6.12.68 to ≤ 6.12.*unaffected6.18.8 to ≤ 6.18.*unaffected6.19 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/b457abeb5d962db88aaf60e249402fd3073dbfab ↗
- https://git.kernel.org/stable/c/8b57bf1d3b1db692f34bce694a03e41be79f6016 ↗
- https://git.kernel.org/stable/c/336fb41a186e7c0415ae94fec9e23d1f04b87483 ↗
- https://git.kernel.org/stable/c/43f233eb6e7b9d88536881a9bc43726d0e34800d ↗
- https://git.kernel.org/stable/c/47634d70073890c9c37e39ab4ff93d4b585b028a ↗
- https://git.kernel.org/stable/c/92e4f11e29b98ef424ff72d6371acac03e5d973c ↗
- https://git.kernel.org/stable/c/26c08dabe5475d99a13f353d8dd70e518de45663 ↗