Linux VC4 DRM Driver Use-After-Free Fix in vc4_perfmon_close_file

From this webpage screenshot, we can extract the following key information about the vulnerability: 1. Vulnerability Description: - Title: - Description: When closing a file descriptor, the active performance monitor is not stopped. Although all performance monitors are destroyed in , the pointer to the active performance monitor ( ) remains unchanged. - Issue: If a new file descriptor is opened and several jobs with performance monitors are submitted, the driver attempts to stop the active performance monitor using the stale pointer stored in . However, this pointer is no longer valid, as the previous process has terminated and all associated performance monitors have been destroyed and freed. 2. Fix: - Code Change: Explicitly stop the active performance monitor while it belongs to the given process, before destroying and freeing it. - Code Snippet: 3. Patch Information: - Patch Author: Maira Canal - Patch Submission Date: October 4, 2024 - Patch Status: Merged into the branch 4. Related Links: - Original Issue: v4.17+ - Author: Maira Canal - Reviewer: Juan A. Suarez 5. Patch Content: - File: - Modified Lines: Lines 116 to 135 - Changes: Added conditional checks in the and functions to ensure the active performance monitor is stopped before being destroyed and freed. This information indicates that the vulnerability relates to the active performance monitor not being properly stopped when closing a file descriptor. The fix resolves this by stopping the active performance monitor before destroying and freeing it.

Goal Reached Thanks to every supporter — we hit 100%!

Linux VC4 DRM Driver Use-After-Free Fix in vc4_perfmon_close_file