CVE-2023-52648

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/vmwgfx: Unmap the surface before resetting it on a plane state<br /> <br /> Switch to a new plane state requires unreferencing of all held surfaces.<br /> In the work required for mob cursors the mapped surfaces started being<br /> cached but the variable indicating whether the surface is currently<br /> mapped was not being reset. This leads to crashes as the duplicated<br /> state, incorrectly, indicates the that surface is mapped even when<br /> no surface is present. That&amp;#39;s because after unreferencing the surface<br /> it&amp;#39;s perfectly possible for the plane to be backed by a bo instead of a<br /> surface.<br /> <br /> Reset the surface mapped flag when unreferencing the plane state surface<br /> to fix null derefs in cleanup. Fixes crashes in KDE KWin 6.0 on Wayland:<br /> <br /> Oops: 0000 [#1] PREEMPT SMP PTI<br /> CPU: 4 PID: 2533 Comm: kwin_wayland Not tainted 6.7.0-rc3-vmwgfx #2<br /> Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020<br /> RIP: 0010:vmw_du_cursor_plane_cleanup_fb+0x124/0x140 [vmwgfx]<br /> Code: 00 00 00 75 3a 48 83 c4 10 5b 5d c3 cc cc cc cc 48 8b b3 a8 00 00 00 48 c7 c7 99 90 43 c0 e8 93 c5 db ca 48 8b 83 a8 00 00 00 8b 78 28 e8 e3 f&gt;<br /> RSP: 0018:ffffb6b98216fa80 EFLAGS: 00010246<br /> RAX: 0000000000000000 RBX: ffff969d84cdcb00 RCX: 0000000000000027<br /> RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff969e75f21600<br /> RBP: ffff969d4143dc50 R08: 0000000000000000 R09: ffffb6b98216f920<br /> R10: 0000000000000003 R11: ffff969e7feb3b10 R12: 0000000000000000<br /> R13: 0000000000000000 R14: 000000000000027b R15: ffff969d49c9fc00<br /> FS: 00007f1e8f1b4180(0000) GS:ffff969e75f00000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 0000000000000028 CR3: 0000000104006004 CR4: 00000000003706f0<br /> Call Trace:<br /> <br /> ? __die+0x23/0x70<br /> ? page_fault_oops+0x171/0x4e0<br /> ? exc_page_fault+0x7f/0x180<br /> ? asm_exc_page_fault+0x26/0x30<br /> ? vmw_du_cursor_plane_cleanup_fb+0x124/0x140 [vmwgfx]<br /> drm_atomic_helper_cleanup_planes+0x9b/0xc0<br /> commit_tail+0xd1/0x130<br /> drm_atomic_helper_commit+0x11a/0x140<br /> drm_atomic_commit+0x97/0xd0<br /> ? __pfx___drm_printfn_info+0x10/0x10<br /> drm_atomic_helper_update_plane+0xf5/0x160<br /> drm_mode_cursor_universal+0x10e/0x270<br /> drm_mode_cursor_common+0x102/0x230<br /> ? __pfx_drm_mode_cursor2_ioctl+0x10/0x10<br /> drm_ioctl_kernel+0xb2/0x110<br /> drm_ioctl+0x26d/0x4b0<br /> ? __pfx_drm_mode_cursor2_ioctl+0x10/0x10<br /> ? __pfx_drm_ioctl+0x10/0x10<br /> vmw_generic_ioctl+0xa4/0x110 [vmwgfx]<br /> __x64_sys_ioctl+0x94/0xd0<br /> do_syscall_64+0x61/0xe0<br /> ? __x64_sys_ioctl+0xaf/0xd0<br /> ? syscall_exit_to_user_mode+0x2b/0x40<br /> ? do_syscall_64+0x70/0xe0<br /> ? __x64_sys_ioctl+0xaf/0xd0<br /> ? syscall_exit_to_user_mode+0x2b/0x40<br /> ? do_syscall_64+0x70/0xe0<br /> ? exc_page_fault+0x7f/0x180<br /> entry_SYSCALL_64_after_hwframe+0x6e/0x76<br /> RIP: 0033:0x7f1e93f279ed<br /> Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 c2 3d 00 f0 ff f&gt;<br /> RSP: 002b:00007ffca0faf600 EFLAGS: 00000246 ORIG_RAX: 0000000000000010<br /> RAX: ffffffffffffffda RBX: 000055db876ed2c0 RCX: 00007f1e93f279ed<br /> RDX: 00007ffca0faf6c0 RSI: 00000000c02464bb RDI: 0000000000000015<br /> RBP: 00007ffca0faf650 R08: 000055db87184010 R09: 0000000000000007<br /> R10: 000055db886471a0 R11: 0000000000000246 R12: 00007ffca0faf6c0<br /> R13: 00000000c02464bb R14: 0000000000000015 R15: 00007ffca0faf790<br /> <br /> Modules linked in: snd_seq_dummy snd_hrtimer nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_ine&gt;<br /> CR2: 0000000000000028<br /> ---[ end trace 0000000000000000 ]---<br /> RIP: 0010:vmw_du_cursor_plane_cleanup_fb+0x124/0x140 [vmwgfx]<br /> Code: 00 00 00 75 3a 48 83 c4 10 5b 5d c3 cc cc cc cc 48 8b b3 a8 00 00 00 48 c7 c7 99 90 43 c0 e8 93 c5 db ca 48 8b 83 a8 00 00 00 8b 78 28 e8 e3 f&gt;<br /> RSP: 0018:ffffb6b98216fa80 EFLAGS: 00010246<br /> RAX: 0000000000000000 RBX: ffff969d84cdcb00 RCX: 0000000000000027<br /> RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff969e75f21600<br /> RBP: ffff969d4143<br /> ---truncated---