Executive brief
The Linux kernel's DRM (Direct Rendering Manager) subsystem for Qualcomm Adreno A6xx GPUs contains a memory management bug where GPU state snapshot data was being allocated with the wrong memory allocation function, leading to memory leaks and potential heap corruption. This affects systems using Adreno A6xx graphics hardware, potentially impacting stability and availability of GPU-accelerated graphics rendering.
Technical details
The vulnerability is a memory management API misuse in the a6xx GPU state snapshot code. The adreno_show_object() function internally reallocates its input pointer using kvmalloc/kvfree, but the calling code was using state_kcalloc() to allocate the initial buffer. This incompatibility resulted in memory leaks (state_kcalloc allocations were never freed with kvfree) and potential use-after-free issues. The fix changes the allocation from state_kcalloc() to kvzalloc() and adds proper kvfree() calls in the cleanup path, along with a warning comment to prevent future regressions. The vulnerability is local to GPU state debugging/capture functionality, not a network-reachable attack surface.
Affected products
- Linux Linux Kernel affected versions include kernels from approximately 5.0 onwards until the patch (commit 83d18e9d9c0150d98dc24e3642ea93f5e245322c from 2022-10-14)
Timeline
- 2022-10-14: disclosed: Fix committed upstream (83d18e9d9c0150d98dc24e3642ea93f5e245322c)
- 2022-11-04: patched: Fix merged into stable kernel (4b1bbc0571a5d7ee10f754186dc3d619b9ced5c1)