Bugzilla – Bug 1222085
VUL-0: CVE-2023-52625: kernel: drm/amd/display: Refactor DMCUB enter/exit idle interface
Last modified: 2024-06-25 18:23:35 UTC
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Refactor DMCUB enter/exit idle interface [Why] We can hang in place trying to send commands when the DMCUB isn't powered on. [How] We need to exit out of the idle state prior to sending a command, but the process that performs the exit also invokes a command itself. Fixing this issue involves the following: 1. Using a software state to track whether or not we need to start the process to exit idle or notify idle. It's possible for the hardware to have exited an idle state without driver knowledge, but entering one is always restricted to a driver allow - which makes the SW state vs HW state mismatch issue purely one of optimization, which should seldomly be hit, if at all. 2. Refactor any instances of exit/notify idle to use a single wrapper that maintains this SW state. This works simialr to dc_allow_idle_optimizations, but works at the DMCUB level and makes sure the state is marked prior to any notify/exit idle so we don't enter an infinite loop. 3. Make sure we exit out of idle prior to sending any commands or waiting for DMCUB idle. This patch takes care of 1/2. A future patch will take care of wrapping DMCUB command submission with calls to this new interface. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-52625 https://www.cve.org/CVERecord?id=CVE-2023-52625 https://git.kernel.org/stable/c/820c3870c491946a78950cdf961bf40e28c1025f https://git.kernel.org/stable/c/8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa https://bugzilla.redhat.com/show_bug.cgi?id=2271682
Fixing commit (820c3870c491) found in: - ALP-current - SLE15-SP6 - SLE15-SP6-GA - stable Other codestreams lack of 0710-drm-amd-display-Add-DCN35-DM-Support.patch and so not affected.
@Patrik: Can you please have a look ./scripts/check-kernel-fix CVE-2023-52625 8e57c06bf4b0 ("drm/amd/display: Refactor DMCUB enter/exit idle interface") merged v6.8-rc1~111^2~1^2~86 Security fix for CVE-2023-52625 bsc#1222085 with CVSS 5.5 .............................. ACTION NEEDED! SLE15-SP5: MANUAL: might need backport of 8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa () SLE12-SP5: MANUAL: might need backport of 8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa () SLE12-SP3-TD: MANUAL: might need backport of 8e57c06bf4b0f51a4d6958e15e1a99c9520d00fa ()
(In reply to Andrea Mattiazzo from comment #1) > Fixing commit (820c3870c491) found in: > - ALP-current > - SLE15-SP6 > - SLE15-SP6-GA > - stable > > Other codestreams lack of 0710-drm-amd-display-Add-DCN35-DM-Support.patch > and so not affected. Yes, this is a fix that is only relevant to DCN35 and newer versions of the display controller. DCN35 was introduced in [1] which is not available in SLE15-SP5, SLE12-SP5 or SLE12-SP3-TD. No further action is needed. Reassigning. [1] 65138eb72e1fc687be49932b9a45325598ffa01c