Medium · published February 26, 2025
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
This issue takes place in an error path in
amdgpu_cs_fence_to_handle_ioctl(). When `info->in.what` falls into
default case, the function simply returns -EINVAL, forgetting to
decrement the reference count of a dma_fence obj, which is bumped
earlier by amdgpu_cs_get_fence(). This may result in reference count
leaks.
Fix it by decreasing the refcount of specific object before returning
the error code.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | < 4.19.238 | 4.19.238 |
| linux/linux_kernel | ≥ 4.20, < 5.4.189 | 5.4.189 |
| linux/linux_kernel | ≥ 5.5, < 5.10.111 | 5.10.111 |
| linux/linux_kernel | ≥ 5.11, < 5.15.34 | 5.15.34 |
| linux/linux_kernel | ≥ 5.16, < 5.16.20 | 5.16.20 |
| linux/linux_kernel | ≥ 5.17, < 5.17.3 | 5.17.3 |