Description
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix use-after-free of mm_struct in job scheduler amdxdna_cmd_submit() stores current->mm in job->mm without holding any reference. aie2_sched_job_run() later access job->mm from the DRM scheduler worker thread. With only a raw pointer and no structural reference, the mm_struct can be freed before the scheduler runs the job. Fix this by calling mmgrab() to hold a structural mm_count reference for the lifetime of the job, paired with mmdrop() in every cleanup path.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
aac243092b707bb3018e951d470cc1a9bcbaba6c to < 6875ee2bef48f5d9f045d81a8a4d68893f768a8aaffectedaac243092b707bb3018e951d470cc1a9bcbaba6c to < e8fadbffc19a233d1eedebfb8df0f522d1388280affectedaac243092b707bb3018e951d470cc1a9bcbaba6c to < faebb7ba1ac65fa5810b640df02ce04e509fdc11affected
Linux Linux
Default version status: affected
6.14affected0 to < 6.14unaffected6.18.42 to ≤ 6.18.*unaffected7.1.6 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected