Description
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table() nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code back to the caller. On failures, ttm will call nouveau_bo_del_ttm() and free the memory.Thus, when nouveau_bo_init() returns an error, the gem object has already been released. Then the call to nouveau_bo_ref() will use the freed "nvbo->bo" and lead to a use-after-free bug. We should delete the call to nouveau_bo_ref() to avoid the use-after-free.
Product status
019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 before 56ee9577915dc06f55309901012a9ef68dbdb5a8
019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 before 5d6093c49c098d86c7b136aba9922df44aeb6944
019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 before 861f085f81fd569b02cc2c11165a9e6cca144424
019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 before 3aeda2fe6517cc52663d4ce3588dd43f0d4124a7
019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 before 7d80473e9f12548ac05b36af4fb9ce80f2f73509
019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 before 540dfd188ea2940582841c1c220bd035a7db0e51
5.4
Any version before 5.4
5.4.220
5.10.150
5.15.75
5.19.17
6.0.3
6.1
References
git.kernel.org/...c/56ee9577915dc06f55309901012a9ef68dbdb5a8
git.kernel.org/...c/5d6093c49c098d86c7b136aba9922df44aeb6944
git.kernel.org/...c/861f085f81fd569b02cc2c11165a9e6cca144424
git.kernel.org/...c/3aeda2fe6517cc52663d4ce3588dd43f0d4124a7
git.kernel.org/...c/7d80473e9f12548ac05b36af4fb9ce80f2f73509
git.kernel.org/...c/540dfd188ea2940582841c1c220bd035a7db0e51
