CVE-2024-57926

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err

The pointer need to be set to NULL, otherwise KASAN complains about

use-after-free. Because in mtk_drm_bind, all private's drm are set

as follows.

private->all_drm_private[i]->drm = drm;

And drm will be released by drm_dev_put in case mtk_drm_kms_init returns

failure. However, the shutdown path still accesses the previous allocated

memory in drm_atomic_helper_shutdown.

[ 84.874820] watchdog: watchdog0: watchdog did not stop!

[ 86.512054] ==================================================================

[ 86.513162] BUG: KASAN: use-after-free in drm_atomic_helper_shutdown+0x33c/0x378

[ 86.514258] Read of size 8 at addr ffff0000d46fc068 by task shutdown/1

[ 86.515213]

[ 86.515455] CPU: 1 UID: 0 PID: 1 Comm: shutdown Not tainted 6.13.0-rc1-mtk+gfa1a78e5d24b-dirty #55

[ 86.516752] Hardware name: Unknown Product/Unknow

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References