Linux: drm/xe: skip eviction of a BO with no resource
What fixes it
- 6046bb9cb2859e3d9bf939e4d6527f3827e1096fLinuxCVE List
- 448e76cbdc6652ccd3ba337b7a6e1f028859f2edLinuxCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: skip eviction of a BO with no resource
xe_evict_flags() switches on tbo->resource->mem_type to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an imported dma-buf BO whose resource was freed during teardown while its attachment is still live: the exporter then invalidates it via xe_dma_buf_move_notify() -> xe_bo_evict(), and the switch dereferences a NULL resource and faults.
A BO with no resource has nothing placed or mapped, so there is nothing to evict. Return an empty placement (num_placement = 0), mirroring the handling already used for non-xe scatter-gather BOs just above; ttm_bo_validate() then takes the pipeline-gutting path and returns 0.
Without the fix the xe_dma_buf@xe_test_dmabuf_move_notify_no_resource dynamic live selftest will fail with below stack.
BUG: kernel NULL pointer dereference, address: 0000000000000010 RIP: 0010:xe_evict_flags+0xf4/0x140 [xe] Call Trace: <TASK> xe_bo_evict+0x40/0xa0 [xe] ? ttm_bo_pipeline_gutting+0x71/0x180 [ttm] xe_test_dmabuf_move_notify_no_resource+0x182/0x440 [xe] xe_dma_buf_kunit+0x387/0x580 [xe]
v2: Add Fixes tag and failure info in commit text (Matt Brost)
(cherry picked from commit dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c)
Text from CVE List
Affected versions 8
- Linuxaffected: dd08ebf6c3525a7ea2186e636df064ea47281987 before 6046bb9cb2859e3d9bf939e4d6527f3827e1096fCVE List
- Linuxaffected: dd08ebf6c3525a7ea2186e636df064ea47281987 before b6499d19ade1f1e4a1e6b739abc8c815297c98b8CVE List
- Linuxaffected: dd08ebf6c3525a7ea2186e636df064ea47281987 before 448e76cbdc6652ccd3ba337b7a6e1f028859f2edCVE List
- Linuxaffected: 6.8CVE List
- Linuxunaffected: all versions before 6.8CVE List
- Linuxunaffected: 6.18.59 through 6.18.*CVE List
- Linuxunaffected: 7.2.13 through 7.2.*CVE List
- Linuxunaffected: 7.3CVE List