CVE-2024-57918 in Linux
Riassunto
di VulDB • 16/06/2026
Based on the kernel stack trace provided, here is an analysis of the issue, its cause, and potential solutions.
### **1. Summary of the Issue** * **Error Type:** `exc_page_fault` (Page Fault) in kernel space. * **Subsystem:** AMDGPU driver (`amdgpu`). * **Specific Function:** `copy_stream_update_to_stream.isra.0` within the Display Core (DC) subsystem. * **Context:** The crash occurred during an atomic commit operation (`amdgpu_dm_atomic_commit_tail`), specifically while updating plane and stream state (`update_planes_and_stream_state` / `update_planes_and_stream_v2`). * **Cherry-picked Commit:** `1c86c81a86c60f9b15d3e3f43af0363cf56063e7`
### **2. Root Cause Analysis** The stack trace indicates a **null pointer dereference** or **invalid memory access** when the AMDGPU driver attempts to copy stream update data.
* **`copy_stream_update_to_stream.isra.0+0x30d/0x750`**: This function is responsible for copying updated display stream parameters (resolution, refresh rate, timing, etc.) from a temporary structure to the active stream structure. * **`exc_page_fault`**: The CPU tried to access a memory address that was not mapped or was invalid. In the context of `copy_stream_update_to_stream`, this most commonly happens when: 1. A pointer to the destination stream (`stream`) is **NULL**. 2. A pointer to the source update structure is **NULL** or corrupted. 3. The stream structure was freed or invalidated before the copy operation completed.
This is a known class of bugs in the AMDGPU DC (Display Core) code, often triggered by: * Rapid display mode changes (e.g., hotplugging monitors, changing resolution/refresh rate). * Multi-monitor setups with mixed refresh rates or scaling modes. * Race conditions during atomic commit where a stream is removed while still being referenced.
### **3. Likely Fix (Based on Cherry-picked Commit)** Since this is a cherry-picked commit, the upstream fix likely involves: * **Null Pointer Checks:** Adding explicit checks for `stream` or `update` pointers before copying. * **Reference Counting:** Ensuring the stream structure remains valid during the copy operation. * **State Validation:** Verifying that the stream is in a valid state before attempting to update it.
### **4. Recommended Actions**
#### **For Users/Developers:** 1. **Update Kernel/Driver:** * Ensure you are running a kernel version that includes the fix from commit `1c86c81a86c60f9b15d3e3f43af0363cf56063e7`. * If you are on a stable kernel, check if a newer point release includes this fix. * If you are using a custom or older kernel, consider backporting this commit.
2. **Workarounds (if the fix is not yet available):** * **Avoid Rapid Mode Changes:** Do not change display resolution/refresh rate while applications are actively rendering or during heavy GPU load. * **Disable Hardware Acceleration:** Temporarily disable GPU hardware acceleration in browsers or desktop environments to see if the crash persists. * **Use a Different Display Manager:** Some users report fewer issues with `gdm` vs `sddm` or vice versa, though this is less likely to be the root cause. * **Check Monitor Cables/Ports:** Faulty HDMI/DP cables can sometimes cause erratic EDID reads, leading to unstable stream states.
3. **Debugging:** * Enable kernel debugging symbols (`CONFIG_DEBUG_INFO=y`) to get a more precise line number in `copy_stream_update_to_stream`. * Check `dmesg` for additional context before the page fault (e.g., warnings about invalid stream pointers).
### **5. Technical Details for Developers** * **File:** Likely `drivers/gpu/drm/amd/display/dc/core/dc_stream.c` or similar. * **Function:** `copy_stream_update_to_stream` * **Key Check:** Look for: ```c if (!stream || !update) return; ``` or similar validation before the copy operation.
If you are maintaining a kernel tree, applying the cherry-picked commit should resolve this specific page fault. If the issue persists, further investigation into the caller (`update
If you want to get best quality of vulnerability data, you may have to visit VulDB.