CVE-2024-57919: drm/amd/display: fix divide error in DM plane scale calcs
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: fix divide error in DM plane scale calcs
dmgetplanescale doesn't take into account plane scaled size equal to zero, leading to a kernel oops due to division by zero. Fix by setting out-scale size as zero when the dst size is zero, similar to what is done by drmcalcscale(). This issue started with the introduction of cursor ovelay mode that uses this function to assess cursor mode changes via dmcrtcgetcursormode() before checking plane state.
[Dec17 17:14] Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI [ +0.000018] CPU: 5 PID: 1660 Comm: surface-DP-1 Not tainted 6.10.0+ #231 [ +0.000007] Hardware name: Valve Jupiter/Jupiter, BIOS F7A0131 01/30/2024 [ +0.000004] RIP: 0010:dmgetplanescale+0x3f/0x60 [amdgpu] [ +0.000553] Code: 44 0f b7 41 3a 44 0f b7 49 3e 83 e0 0f 48 0f a3 c2 73 21 69 41 28 e8 03 00 00 31 d2 41 f7 f1 31 d2 89 06 69 41 2c e8 03 00 00 <41> f7 f0 89 07 e9 d7 d8 7e e9 44 89 c8 45 89 c1 41 89 c0 eb d4 66 [ +0.000005] RSP: 0018:ffffa8df0de6b8a0 EFLAGS: 00010246 [ +0.000006] RAX: 00000000000003e8 RBX: ffff9ac65c1f6e00 RCX: ffff9ac65d055500 [ +0.000003] RDX: 0000000000000000 RSI: ffffa8df0de6b8b0 RDI: ffffa8df0de6b8b4 [ +0.000004] RBP: ffff9ac64e7a5800 R08: 0000000000000000 R09: 0000000000000a00 [ +0.000003] R10: 00000000000000ff R11: 0000000000000054 R12: ffff9ac6d0700010 [ +0.000003] R13: ffff9ac65d054f00 R14: ffff9ac65d055500 R15: ffff9ac64e7a60a0 [ +0.000004] FS: 00007f869ea00640(0000) GS:ffff9ac970080000(0000) knlGS:0000000000000000 [ +0.000004] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000003] CR2: 000055ca701becd0 CR3: 000000010e7f2000 CR4: 0000000000350ef0 [ +0.000004] Call Trace: [ +0.000007] <TASK> [ +0.000006] ? diebody.cold+0x19/0x27 [ +0.000009] ? die+0x2e/0x50 [ +0.000007] ? dotrap+0xca/0x110 [ +0.000007] ? doerrortrap+0x6a/0x90 [ +0.000006] ? dmgetplanescale+0x3f/0x60 [amdgpu] [ +0.000504] ? excdivideerror+0x38/0x50 [ +0.000005] ? dmgetplanescale+0x3f/0x60 [amdgpu] [ +0.000488] ? asmexcdivideerror+0x1a/0x20 [ +0.000011] ? dmgetplanescale+0x3f/0x60 [amdgpu] [ +0.000593] dmcrtcgetcursormode+0x33f/0x430 [amdgpu] [ +0.000562] amdgpudmatomiccheck+0x2ef/0x1770 [amdgpu] [ +0.000501] drmatomiccheckonly+0x5e1/0xa30 [drm] [ +0.000047] drmmodeatomicioctl+0x832/0xcb0 [drm] [ +0.000050] ? pfxdrmmodeatomicioctl+0x10/0x10 [drm] [ +0.000047] drmioctlkernel+0xb3/0x100 [drm] [ +0.000062] drmioctl+0x27a/0x4f0 [drm] [ +0.000049] ? pfxdrmmodeatomicioctl+0x10/0x10 [drm] [ +0.000055] amdgpudrmioctl+0x4e/0x90 [amdgpu] [ +0.000360] x64sysioctl+0x97/0xd0 [ +0.000010] dosyscall64+0x82/0x190 [ +0.000008] ? pfxdrmmodecreateblobioctl+0x10/0x10 [drm] [ +0.000044] ? srsoreturnthunk+0x5/0x5f [ +0.000006] ? drmioctlkernel+0xb3/0x100 [drm] [ +0.000040] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? checkobjectsize+0x50/0x220 [ +0.000007] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? drmioctl+0x2a4/0x4f0 [drm] [ +0.000039] ? pfxdrmmodecreateblobioctl+0x10/0x10 [drm] [ +0.000043] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? pmruntimesuspend+0x69/0xc0 [ +0.000006] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? amdgpudrmioctl+0x71/0x90 [amdgpu] [ +0.000366] ? srsoreturnthunk+0x5/0x5f [ +0.000006] ? syscallexittousermode+0x77/0x210 [ +0.000007] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? dosyscall64+0x8e/0x190 [ +0.000006] ? srsoreturnthunk+0x5/0x5f [ +0.000006] ? dosyscall64+0x8e/0x190 [ +0.000006] ? srsoreturnthunk+0x5/0x5f [ +0.000007] entrySYSCALL64afterhwframe+0x76/0x7e [ +0.000008] RIP: 0033:0x55bb7cd962bc [ +0.000007] Code: 4c 89 6c 24 18 4c 89 64 24 20 4c 89 74 24 28 0f 57 c0 0f 11 44 24 30 89 c7 48 8d 54 24 08 b8 10 00 00 00 be bc 64 ---truncated---
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-57919?
The severity of CVE-2024-57919 is classified as a potentially high-impact vulnerability due to the resulting kernel oops.
How do I fix CVE-2024-57919?
To fix CVE-2024-57919, you need to update the Linux kernel to a version that includes the patch for this vulnerability.
What components are affected by CVE-2024-57919?
CVE-2024-57919 affects the Linux kernel specifically in the drm/amd/display module.
Which Linux kernel versions are vulnerable to CVE-2024-57919?
Linux kernel versions between 6.11 and 6.13-rc6 are affected by CVE-2024-57919.
Is there a known exploit for CVE-2024-57919?
As of now, there are no publicly disclosed exploits for CVE-2024-57919.