Description
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3d_get_cpu_indirect_csd_params() looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes drm_gem_object_lookup() return NULL, which is then stored in info->indirect and only dereferenced later when the indirect CSD job runs, turning a userspace mistake into a NULL pointer dereference in the kernel. Bail out with -ENOENT as soon as the lookup fails, so the bad handle is rejected at submission time.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
18b8413b25b7070fa2e55858a2c808e6909581d0 to < 7c27f630dc78b673e136cab7d410399a1c52146aaffected18b8413b25b7070fa2e55858a2c808e6909581d0 to < 762116dfa72865c82151970960f7cf34f44b21c8affected18b8413b25b7070fa2e55858a2c808e6909581d0 to < 5d65dade4d84913d1879f3db6a12ac007e08314baffected18b8413b25b7070fa2e55858a2c808e6909581d0 to < 2f8b8593c7832fad655290cef9e99af05b1b52b3affected
Linux Linux
Default version status: affected
6.8affected0 to < 6.8unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected