In the Linux kernel, the following vulnerability has been resolved: drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj This issue takes place in an error path in amdgpu_cs_fence_to_handle_ioctl()

Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj

This issue takes place in an error path in amdgpu_cs_fence_to_handle_ioctl(). When info->in.what falls into default case, the function simply returns -EINVAL, forgetting to decrement the reference count of a dma_fence obj, which is bumped earlier by amdgpu_cs_get_fence(). This may result in reference count leaks.

Fix it by decreasing the refcount of specific object before returning the error code.

Affected

• linux_kernel < 4.19.238
• linux_kernel >= 4.20, < 5.4.189
• linux_kernel >= 5.5, < 5.10.111
• linux_kernel >= 5.11, < 5.15.34
• linux_kernel >= 5.16, < 5.16.20
• linux_kernel >= 5.17, < 5.17.3

Remediation

Upgrade past the affected range:

• linux_kernel 5.17.3