62 lines
2.2 KiB
Diff
Executable File
62 lines
2.2 KiB
Diff
Executable File
From 660faca456f682c42086c04c819f120fc21628e1 Mon Sep 17 00:00:00 2001
|
|
From: tonli01 <[email protected]>
|
|
Date: Wed, 03 Sep 2025 16:27:51 +0800
|
|
Subject: [PATCH] [Offical]CVE-2025-8045 Potential race condition in CPU-QUEUE dumps Fix race that causes double free of cpu-queue dump-buf
|
|
|
|
This commit fixes a cpu-queue dump-buffer being left dangling after
|
|
the dump-control closed the window of accepting new inputs, posing
|
|
potential risk of triggering double free on the dangling buffer.
|
|
|
|
The fix ensures that a bump-buffer deposited into the dump-control is
|
|
dealt with after closing the inputs accepting window, excluding any
|
|
chance of a dangling dump-buffer being present.
|
|
|
|
Change-Id: I8c2feb03233e5da00443507920b5938544f8b5ab
|
|
---
|
|
|
|
diff --git a/mali_kbase_csf_cpu_queue.c b/mali_kbase_csf_cpu_queue.c
|
|
index 22330d3..4ebf624 100644
|
|
--- a/mali_kbase_csf_cpu_queue.c
|
|
+++ b/mali_kbase_csf_cpu_queue.c
|
|
@@ -83,8 +83,10 @@
|
|
kctx->csf.cpu_queue.buffer = dump_buffer;
|
|
kctx->csf.cpu_queue.buffer_size = buf_size;
|
|
complete_all(&kctx->csf.cpu_queue.dump_cmp);
|
|
- } else
|
|
+ } else {
|
|
kfree(dump_buffer);
|
|
+ kctx->csf.cpu_queue.buffer = NULL;
|
|
+ }
|
|
|
|
mutex_unlock(&kctx->csf.lock);
|
|
|
|
@@ -93,7 +95,7 @@
|
|
|
|
int kbasep_csf_cpu_queue_dump_print(struct kbase_context *kctx, struct kbasep_printer *kbpr)
|
|
{
|
|
- bool timed_out = false;
|
|
+ bool timed_out;
|
|
|
|
mutex_lock(&kctx->csf.lock);
|
|
if (atomic_read(&kctx->csf.cpu_queue.dump_req_status) != BASE_CSF_CPU_QUEUE_DUMP_COMPLETE) {
|
|
@@ -110,14 +112,15 @@
|
|
kbasep_print(kbpr, "CPU Queues table (version:v" __stringify(
|
|
MALI_CSF_CPU_QUEUE_DUMP_VERSION) "):\n");
|
|
|
|
- if (WARN_ON(!wait_for_completion_timeout(&kctx->csf.cpu_queue.dump_cmp,
|
|
- msecs_to_jiffies(3000)))) {
|
|
+ timed_out =
|
|
+ !wait_for_completion_timeout(&kctx->csf.cpu_queue.dump_cmp, msecs_to_jiffies(3000));
|
|
+ if (timed_out) {
|
|
+ dev_warn(kctx->kbdev->dev, "Wait for cpu_queue dump completion time_out");
|
|
kbasep_print(kbpr, "Failed to wait for completion of dump request\n");
|
|
- timed_out = true;
|
|
}
|
|
|
|
mutex_lock(&kctx->csf.lock);
|
|
- if (!timed_out && kctx->csf.cpu_queue.buffer) {
|
|
+ if (kctx->csf.cpu_queue.buffer) {
|
|
WARN_ON(atomic_read(&kctx->csf.cpu_queue.dump_req_status) !=
|
|
BASE_CSF_CPU_QUEUE_DUMP_PENDING);
|
|
|