Alex Deucher

A vulnerability in the Linux kernel has been resolved. The issue was related to a commit that used the HW lock manager for PSR1, which could cause a system hang when connecting with two eDP panels.

The issue is related to the handling of plane refcount in the Linux kernel's drm/amd/display module. The mechanism to backup and restore plane states does not maintain the refcount, which can cause problems if the refcount of the plane changes between backup and restore operations. This can lead to memory leaks if the refcount was supposed to go down, or double frees/invalid memory accesses if the refcount was supposed to go up. The fix involves caching and re-applying the current refcount when restoring plane states.

The issue is related to the `dc state copy internal` function in the Linux kernel's `drm/amd/display` module. It concerns a double free vulnerability that occurs when a `dml` allocation fails, causing subsequent calls to `dc state copy internal` to shallow copy invalid memory. If the new state is released, a double free would occur, potentially allowing an attacker to impact the confidentiality, integrity, and availability of protected information.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: A buffer overflow issue has been identified in the Linux kernel, specifically in the `amdgpu debugfs gprwave read()` function. This issue can occur when the size is larger than 4K, potentially leading to a buffer overflow. The vulnerability is related to a missing size check. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue concerns memory corruption caused by array indices being out of bounds. To address this, checks have been added to ensure array indices stay within bounds, specifically in the drm/amd/display component of the Linux kernel.

The issue occurs when a monitor connected after an MST hub is unplugged, resulting in a null pointer dereference. This happens because `dc sink` is released immediately in `early unregister()` or `detect ctx()`, and committing a new state that refers to information stored in `dc sink` causes a null pointer dereference. The problem is resolved by removing a redundant checking condition and resetting `dsc aux` to NULL when the connector is disconnected.

The issue is related to a double free problem in the Linux kernel's amdgpu module. Specifically, the `link destruct()` function in the `drivers/gpu/drm/amd/display/dc/link/link factory.c` file is vulnerable to repeated freeing of previously freed memory. This could potentially allow an attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability occurs when unloading the amdgpu module, and it involves the `dcn10 link encoder destroy()` and `link destroy()` functions.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: The issue is related to an index out of bounds problem in the `cm3 helper translate curve to hw format` function within the DCN30 color management module. This could occur when the index `i` exceeds the number of transfer function points. The fix involves adding a check to ensure `i` is within bounds before accessing the transfer function points, returning false to indicate an error if `i` is out of bounds. Buffer overflows could occur in `output tf->tf pts.red`, `output tf->tf pts.green`, and `output tf->tf pts.blue` due to the index issue. Recommendations: For Linux kernel versions prior to 6.6.58, update to version 6.6.58 or later to resolve the issue. As a temporary workaround, consider restricting access to the DCN30 color management module until the update can be applied.

The issue is related to a null pointer dereference in the `dcn20 resource.c` file of the Linux kernel's `drm/amd/display` module. This vulnerability can cause a hang when running MPV on a DCN401 dGPU with specific settings, such as `mpv --hwdec=vaapi --vo=gpu --hwdec-codecs=all`, and then enabling fullscreen playback. The call trace shows a kernel NULL pointer dereference at address 0000000000000000.

A null pointer dereference issue has been resolved in the Linux kernel, specifically in the drm/amd/pm module for vega10 hwmgr. The fix involves checking return values and conducting null pointer handling to avoid null pointer dereferences.

A NULL pointer dereference vulnerability has been resolved in the Linux kernel, specifically in the drm/amd/display component. The issue occurs when the color log tries to read the gamut remap information from DCN401, which is not initialized in the dcn401 dpp funcs, leading to a null pointer dereference. This vulnerability is addressed by adding a proper guard to access the gamut remap callback in case the specific ASIC did not implement this function. The vulnerability can be triggered by running the command `cat /sys/kernel/debug/dri/0/amdgpu dm dtn log`.

The issue is related to a bounds check in the Linux kernel's drm/amd/display component, specifically for dcn35 DcfClocks. The problem arises because `NumFclkLevelsEnabled` is used instead of the designated `NumDcfClkLevelsEnabled` for the bounds check, potentially causing an array index out-of-bounds access.

The issue is related to the drm/amdkfd module in the Linux kernel, where mapping the MMIO HDP page with large pages is not allowed due to incorrect offset handling. This can expose PAGE SIZE of MMIO space on systems with page sizes greater than 4K. The GPU has an unused 4K area in the register BAR space where registers can be remapped, including HDP flush registers, to allow userspace to flush the HDP when updating VRAM.

A NULL pointer dereference issue has been resolved in the Linux kernel. The issue occurs when getting the power limit due to the powerplay table initialization being skipped under the sriov case. To address this, default lower and upper OD values are set if the powerplay table is NULL.

The issue is related to an out-of-bounds access in the mmhub client id handling, specifically with cid 0x140. This has been resolved by properly handling the cid.

A dynamic memory safety error detector (KASAN) catches and generates error messages "BUG: KASAN: slab-out-of-bounds" as the writeback connector does not support certain features which are not initialized. The issue occurs in the drm/amd/display component when it attempts to write back data. To resolve this, the connector type is checked, and if it is DRM MODE CONNECTOR WRITEBACK, the operation is skipped.

There is a potential memory access violation while iterating through an array of dcn35 clks. This issue can be resolved by limiting iteration per array size.

The issue is related to the drm/amd/display component of the Linux kernel, where two problems have been fixed: a comparison with a wider integer type in a loop condition that can cause infinite loops, and a pointer dereference before a null check.

The issue is related to the Linux kernel, where a commit caused GFXOFF control to be used more heavily, leading to a codepath that can be exercised at suspend again, resulting in potential SDMA traffic and system deadlock when using GNOME to suspend the lockscreen trigger.

The issue arises when the array `adev->vcn.vcn config` is accessed before checking if the index `adev->vcn.num vcn inst` is within the bounds of the array. The fix involves moving the bounds check before the array access. This ensures that `adev->vcn.num vcn inst` is within the bounds of the array before it is used as an index.