The Nasty Linux 6.3 Nouveau Driving force Computer virus Seems To Have Been Figured Out

As a follow-up to the doubtless nasty open-source NVIDIA “Nouveau” motive force trojan horse in Linux 6.3, the problem is thought to had been discovered and a area is pending that looks to handle the problem.

A ultimatum was once despatched out a couple of days in the past to keep away from the usage of Nouveau at the flow Linux 6.3 solid form because of a use-after-free factor inside of this kernel graphics motive force. The use-after-free can top to kernel reminiscence corruption and in flip may just doubtlessly motive file-system corruption or alternative components problems, to not point out being a imaginable safety factor as smartly.

Crimson Hat’s David Airlie believes now he has taken care of via the problem from the month-old trojan horse record. Airlie posted a area the day before today as a proposed medication. Up to now each Nouveau developer Karol Herbst at Crimson Hat in addition to any other person up to now plagued by way of this sickness have indicated the use-after-free factor is now have shyed away from.

Airlie defined when posting the area to dri-devel:

“This seems to have existed for ever but is now more apparant after 9bff18d13473a9fdf81d5158248472a9d8ecf2bd (drm/ttm: use per BO cleanup workers)

My analysis:
two threads are running, one in the irq signalling the fence, in dma_fence_signal_timestamp_locked, it has done the DMA_FENCE_FLAG_SIGNALLED_BIT setting, but hasn’t yet reached the callbacks.

second thread in nouveau_cli_work_ready, where it sees the fence is signalled, so then puts the fence, cleanups the object and frees the work item, which contains the callback.

thread one goes again and tries to call the callback and causes the use-after-free.

Proposed fix:
lock the fence signalled check in nouveau_cli_work_ready, so either the callbacks are done or the memory is freed.”

With a couple of traces of code, the sickness is optimistically resolved.

GeForce 7800 GTX opening a drink

On the while the area continues to be sitting at the mailing checklist however will possibly be despatched in for the nearest spherical of DRM-Medications being despatched in for the mainline kernel.

Leave a Comment