)]}'
{
  "commit": "6384271ac1ac0099198d15df79212a19ebdb929d",
  "tree": "75a03d6cd3f01a7f79e707a0ad3689604c628188",
  "parents": [
    "ad87e2476b3b246580f407afc8ffa91d621bc849"
  ],
  "author": {
    "name": "Zongyao Bai",
    "email": "zongyao.bai@intel.com",
    "time": "Tue Jul 14 23:24:32 2026 +0000"
  },
  "committer": {
    "name": "Thomas Hellström",
    "email": "thomas.hellstrom@linux.intel.com",
    "time": "Thu Jul 16 16:32:56 2026 +0200"
  },
  "message": "drm/xe/pt: Reset current_op in xe_pt_update_ops_init()\n\nxe_pt_update_ops_init() fails to reset current_op to 0. On the\nvm_bind path, ops_execute() calls xe_pt_update_ops_prepare() inside\nthe xe_validation_guard() / drm_exec_until_all_locked() loop. When\nthat loop retries due to lock contention or OOM eviction\n(drm_exec_retry_on_contention() / xe_validation_retry_on_oom()),\nxe_pt_update_ops_prepare() runs again on the same vops, and each\ncall to bind_op_prepare() increments current_op without resetting it.\n\nAfter N retries current_op exceeds the array size allocated by\nxe_vma_ops_alloc(), causing an out-of-bounds write into\nSLUB-poisoned memory and a subsequent UAF crash in\nxe_migrate_update_pgtables_cpu() when reading the corrupted pt_op-\u003ebind.\n\nAlso reset needs_svm_lock and needs_invalidation which are derived in\nthe same prepare pass and would otherwise cause wrong migrate ops\nselection and redundant TLB invalidation on retry.\n\nFix this by resetting current_op, needs_svm_lock and needs_invalidation\nin xe_pt_update_ops_init().\n\nv2 (Matt):\n   - Add details in commit message.\n   - Add Fixes tag and Cc to stable@vger.kernel.org\n\nFixes: e8babb280b5e (\"drm/xe: Convert multiple bind ops into single job\")\nSuggested-by: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nCc: stable@vger.kernel.org\nAssisted-by: GitHub-Copilot:claude-sonnet-4.6\nSigned-off-by: Zongyao Bai \u003czongyao.bai@intel.com\u003e\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260714232433.2737533-1-zongyao.bai@intel.com\n(cherry picked from commit 046045543e530605c441063535e7dca0075369a6)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e787c0c27c426151cdecd39261daefa269627fdb",
      "old_mode": 33188,
      "old_path": "drivers/gpu/drm/xe/xe_pt.c",
      "new_id": "39c9c8f0ea2d20b19d2cb5925d1b167dc0411434",
      "new_mode": 33188,
      "new_path": "drivers/gpu/drm/xe/xe_pt.c"
    }
  ]
}