Description
In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Tie IIO dma fence lock lifetime to the fence The `iio_dma_fence` implementation currently uses a lock embedded in the `iio_dmabuf_priv`. But the `iio_dma_fence` can outlive the `iio_dmabuf_priv`, which can cause a use-after-free. Tie the lifetime of the lock to the lifetime of the fence by embedding them in the same struct. We can't just hold a reference to the `iio_dmabuf_priv` from the `iio_dma_fence` since `iio_buffer_dmabuf_release()` might sleep and the fence release callback is not allowed to sleep. Note that the `dma_fence` framework now has an internal lock that gets used when the passing `NULL` for `lock` in `dma_fence_init()`, but in order to allow this patch to be backportable use an external lock.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f to < 6865d79fca17a80fbd60c12550ca9a5e0e20e0ebaffected3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f to < 510497e31be4f241103507315a859e2085ccb081affected3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f to < 8b3e221590181a8beb3735bbabf166df02c839b5affected3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f to < f25ec4627d935dedfb5fe83bd2c2678cdcc19611affected
Linux Linux
Default version status: affected
6.11affected0 to < 6.11unaffected6.12.110 to ≤ 6.12.*unaffected6.18.51 to ≤ 6.18.*unaffected7.2.5 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected