Description
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure Two paths through vmw_vkms_init() can leave vmw->crc_workq NULL while still leaving the rest of the driver in a state that calls vmw_vkms_cleanup() at module unload: 1. vmw_host_get_guestinfo(GUESTINFO_VBLANK, ...) failing or returning an oversized buffer -- the common case on hosts without a VBLANK guestinfo entry -- early-returned before the workqueue allocation. 2. alloc_ordered_workqueue() returning NULL on memory pressure. vmw_vkms_cleanup() then calls destroy_workqueue(NULL), which dereferences wq->name and panics. Fix the first case by removing the early return: vmw->vkms_enabled is already false on the rpci-failure path so no work will ever be queued, and allocating the workqueue unconditionally keeps the control flow simple. Fix the second case by guarding the cleanup with a NULL check, since alloc_ordered_workqueue() can still fail under low memory.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7b0062036c3b71b4a69e244ecf0502c06c4cf5f0 to < 7c701778c6a369769992614dac8dc00c8ac72afcaffected7b0062036c3b71b4a69e244ecf0502c06c4cf5f0 to < 96efee36453b697ccbaf75091b7a1807c11809ddaffected7b0062036c3b71b4a69e244ecf0502c06c4cf5f0 to < 0ee0532f1d405d37f38c44cbba87342e63d3bbd4affected7b0062036c3b71b4a69e244ecf0502c06c4cf5f0 to < 05eaa887e7b4f40fba425f8a1d7a5a8a043092a6affected
Linux Linux
Default version status: affected
6.10affected0 to < 6.10unaffected6.12.103 to ≤ 6.12.*unaffected6.18.44 to ≤ 6.18.*unaffected7.1.8 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected