{
   "containers": {
      "cna": {
         "providerMetadata": {
            "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038"
         },
         "descriptions": [
            {
               "lang": "en",
               "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dpu: cleanup FB if dpu_format_populate_layout fails\n\nIf the dpu_format_populate_layout() fails, then FB is prepared, but not\ncleaned up. This ends up leaking the pin_count on the GEM object and\ncauses a splat during DRM file closure:\n\nmsm_obj->pin_count\nWARNING: CPU: 2 PID: 569 at drivers/gpu/drm/msm/msm_gem.c:121 update_lru_locked+0xc4/0xcc\n[...]\nCall trace:\n update_lru_locked+0xc4/0xcc\n put_pages+0xac/0x100\n msm_gem_free_object+0x138/0x180\n drm_gem_object_free+0x1c/0x30\n drm_gem_object_handle_put_unlocked+0x108/0x10c\n drm_gem_object_release_handle+0x58/0x70\n idr_for_each+0x68/0xec\n drm_gem_release+0x28/0x40\n drm_file_free+0x174/0x234\n drm_release+0xb0/0x160\n __fput+0xc0/0x2c8\n __fput_sync+0x50/0x5c\n __arm64_sys_close+0x38/0x7c\n invoke_syscall+0x48/0x118\n el0_svc_common.constprop.0+0x40/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x4c/0x120\n el0t_64_sync_handler+0x100/0x12c\n el0t_64_sync+0x190/0x194\nirq event stamp: 129818\nhardirqs last  enabled at (129817): [<ffffa5f6d953fcc0>] console_unlock+0x118/0x124\nhardirqs last disabled at (129818): [<ffffa5f6da7dcf04>] el1_dbg+0x24/0x8c\nsoftirqs last  enabled at (129808): [<ffffa5f6d94afc18>] handle_softirqs+0x4c8/0x4e8\nsoftirqs last disabled at (129785): [<ffffa5f6d94105e4>] __do_softirq+0x14/0x20\n\nPatchwork: https://patchwork.freedesktop.org/patch/600714/"
            }
         ],
         "affected": [
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "unaffected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c"
               ],
               "versions": [
                  {
                     "version": "25fdd5933e4c",
                     "lessThan": "9b8b65211a88",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "25fdd5933e4c",
                     "lessThan": "7ecf85542169",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "25fdd5933e4c",
                     "lessThan": "a3c5815b07f4",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "25fdd5933e4c",
                     "lessThan": "02193c707231",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "25fdd5933e4c",
                     "lessThan": "bfa1a6283be3",
                     "status": "affected",
                     "versionType": "git"
                  }
               ]
            },
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "affected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c"
               ],
               "versions": [
                  {
                     "version": "4.19",
                     "status": "affected"
                  },
                  {
                     "version": "0",
                     "lessThan": "4.19",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "5.15.166",
                     "lessThanOrEqual": "5.15.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.1.107",
                     "lessThanOrEqual": "6.1.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.6.48",
                     "lessThanOrEqual": "6.6.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.10.7",
                     "lessThanOrEqual": "6.10.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.11",
                     "lessThanOrEqual": "*",
                     "status": "unaffected",
                     "versionType": "original_commit_for_fix"
                  }
               ]
            }
         ],
         "references": [
            {
               "url": "https://git.kernel.org/stable/c/9b8b65211a880af8fe8330a101e1e239a2d4008f"
            },
            {
               "url": "https://git.kernel.org/stable/c/7ecf85542169012765e4c2817cd3be6c2e009962"
            },
            {
               "url": "https://git.kernel.org/stable/c/a3c5815b07f4ee19d0b7e2ddf91ff9f03ecbf27d"
            },
            {
               "url": "https://git.kernel.org/stable/c/02193c70723118889281f75b88722b26b58bf4ae"
            },
            {
               "url": "https://git.kernel.org/stable/c/bfa1a6283be390947d3649c482e5167186a37016"
            }
         ],
         "title": "drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails",
         "x_generator": {
            "engine": "bippy-c9c4e1df01b2"
         }
      }
   },
   "cveMetadata": {
      "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038",
      "cveID": "CVE-2024-44982",
      "requesterUserId": "gregkh@kernel.org",
      "serial": "1",
      "state": "PUBLISHED"
   },
   "dataType": "CVE_RECORD",
   "dataVersion": "5.0"
}