CVE-2024-43909: Linux Kernel Vulnerability Resolved - drm/amdgpu/pm: Fix the null pointer dereference for smu7

In recent times, a significant vulnerability has been identified and resolved in the Linux kernel. This vulnerability is tracked as CVE-2024-43909 and pertains to the Direct Rendering Manager (DRM) for AMD GPU (amdgpu) power management (pm) subsystem. The issue at hand concerns the null pointer dereference for smu7 in the Linux kernel source code, potentially leading to system crashes and other undesired behaviours.

In this detailed post, we will analyze the root cause of the issue, highlight the changes implemented to mitigate the vulnerability and provide relevant sources for future reference.

A deep dive into the problem

The main problem in the kernel code was related to a null pointer being passed as an argument to the smu7_update_edc_leakage_table() function within the DRM/amdgpu/pm subsystem. The hardware manager backend (hwmgr->backend) was not being validated before being used as an argument, resulting in a potential null pointer dereference.

Here's the original problematic code snippet

static int smu7_update_edc_leakage_table(struct pp_hwmgr *hwmgr)
{
...
    backend = hwmgr->backend;
...
}

As seen in the above code snippet, the backend variable was assigned the pointer to hwmgr->backend, but there was no check for a null pointer before using it.

The fix applied

To fix this issue, the code was optimized to check for a null pointer before using it as an argument. The updated code snippet is as follows:

static int smu7_update_edc_leakage_table(struct pp_hwmgr *hwmgr)
{
...
    if (!hwmgr || !hwmgr->backend)
        return -EINVAL;
    backend=hwmgr->backend;
...
}

As seen in the updated code, a null check is done for both hwmgr and hwmgr->backend. If either of these pointers is null, the function returns an error code -EINVAL, indicating an invalid argument.

Exploit details

As detailed earlier, the vulnerability in the Linux kernel's DRM/amdgpu/pm subsystem led to null pointer dereference issues for smu7. This could cause the system to behave erratically or crash unexpectedly, thereby affecting the reliability and availability of the affected systems or devices.

The patch to resolve this issue has been applied to the mainline kernel, ensuring that systems processing AMD GPU tasks are no longer exposed to possible crashes due to null pointer dereference.

Relevant references

To further explore the details of the vulnerability, as well as the applied patch, the following resources should prove helpful:
1. Kernel.org - Patch link
2. Linux Kernel Mailing List (LKML) - Patch discussion

In conclusion, the vulnerability CVE-2024-43909 in the Linux kernel has been fixed by properly handling null pointer dereferences in the DRM/amdgpu/pm subsystem. This resolution ensures that the Linux kernel remains robust and reliable, maintaining the stability users have come to expect from the platform.

Timeline

Published on: 08/26/2024 11:15:05 UTC
Last modified on: 08/27/2024 13:41:48 UTC