CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's handling of GEM (Graphics Execution Manager) handles, specifically in the `rocket_ioctl_create_bo()` function, which can lead to a use-after-free (UAF) condition due to improper error handling. This flaw allows an attacker to dereference freed memory, potentially leading to arbitrary code execution or system crashes. Organizations using affected Linux kernel versions, particularly those leveraging graphics processing capabilities, should prioritize patching this vulnerability to mitigate risks associated with UAF exploits.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in create_bo rocket_ioctl_create_bo() inserts a GEM handle into the file's IDR via drm_gem_handle_create() early on, then performs several operations that can fail (sgt allocation, drm_mm insert, iommu_map). If any fail after the handle is live, the error path calls drm_gem_shmem_object_free() which kfree's the object without removing the handle from the IDR. This leaves a dangling handle pointing to freed slab memory. Any subsequent ioctl using that handle (PREP_BO, FINI_BO, SUBMIT) calls drm_gem_object_lookup() and dereferences freed memory (UAF). Fix by moving drm_gem_handle_create() to after all fallible operations succeed, matching the pattern used by panfrost, lima, and etnaviv. Also fix drm_mm_insert_node_generic() whose return value was silently overwritten by iommu_map_sgtable() on the next line. Add the missing error check. [tomeu: Move handle creation to the very end]