cve/published/2024/CVE-2024-26937.mbox - pub/scm/linux/security/vulns - Git at Google

 From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
 From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 To: <linux-cve-announce@vger.kernel.org>
 Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
 Subject: CVE-2024-26937: drm/i915/gt: Reset queue_priority_hint on parking

 Description
 ===========

 In the Linux kernel, the following vulnerability has been resolved:

 drm/i915/gt: Reset queue_priority_hint on parking

 Originally, with strict in order execution, we could complete execution
 only when the queue was empty. Preempt-to-busy allows replacement of an
 active request that may complete before the preemption is processed by
 HW. If that happens, the request is retired from the queue, but the
 queue_priority_hint remains set, preventing direct submission until
 after the next CS interrupt is processed.

 This preempt-to-busy race can be triggered by the heartbeat, which will
 also act as the power-management barrier and upon completion allow us to
 idle the HW. We may process the completion of the heartbeat, and begin
 parking the engine before the CS event that restores the
 queue_priority_hint, causing us to fail the assertion that it is MIN.

 <3>[  166.210729] __engine_park:283 GEM_BUG_ON(engine->sched_engine->queue_priority_hint != (-((int)(~0U >> 1)) - 1))
 <0>[  166.210781] Dumping ftrace buffer:
 <0>[  166.210795] ---------------------------------
 ...
 <0>[  167.302811] drm_fdin-1097      2..s1. 165741070us : trace_ports: 0000:00:02.0 rcs0: promote { ccid:20 1217:2 prio 0 }
 <0>[  167.302861] drm_fdin-1097      2d.s2. 165741072us : execlists_submission_tasklet: 0000:00:02.0 rcs0: preempting last=1217:2, prio=0, hint=2147483646
 <0>[  167.302928] drm_fdin-1097      2d.s2. 165741072us : __i915_request_unsubmit: 0000:00:02.0 rcs0: fence 1217:2, current 0
 <0>[  167.302992] drm_fdin-1097      2d.s2. 165741073us : __i915_request_submit: 0000:00:02.0 rcs0: fence 3:4660, current 4659
 <0>[  167.303044] drm_fdin-1097      2d.s1. 165741076us : execlists_submission_tasklet: 0000:00:02.0 rcs0: context:3 schedule-in, ccid:40
 <0>[  167.303095] drm_fdin-1097      2d.s1. 165741077us : trace_ports: 0000:00:02.0 rcs0: submit { ccid:40 3:4660* prio 2147483646 }
 <0>[  167.303159] kworker/-89       11..... 165741139us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence c90:2, current 2
 <0>[  167.303208] kworker/-89       11..... 165741148us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:c90 unpin
 <0>[  167.303272] kworker/-89       11..... 165741159us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 1217:2, current 2
 <0>[  167.303321] kworker/-89       11..... 165741166us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:1217 unpin
 <0>[  167.303384] kworker/-89       11..... 165741170us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 3:4660, current 4660
 <0>[  167.303434] kworker/-89       11d..1. 165741172us : __intel_context_retire: 0000:00:02.0 rcs0: context:1216 retire runtime: { total:56028ns, avg:56028ns }
 <0>[  167.303484] kworker/-89       11..... 165741198us : __engine_park: 0000:00:02.0 rcs0: parked
 <0>[  167.303534]   <idle>-0         5d.H3. 165741207us : execlists_irq_handler: 0000:00:02.0 rcs0: semaphore yield: 00000040
 <0>[  167.303583] kworker/-89       11..... 165741397us : __intel_context_retire: 0000:00:02.0 rcs0: context:1217 retire runtime: { total:325575ns, avg:0ns }
 <0>[  167.303756] kworker/-89       11..... 165741777us : __intel_context_retire: 0000:00:02.0 rcs0: context:c90 retire runtime: { total:0ns, avg:0ns }
 <0>[  167.303806] kworker/-89       11..... 165742017us : __engine_park: __engine_park:283 GEM_BUG_ON(engine->sched_engine->queue_priority_hint != (-((int)(~0U >> 1)) - 1))
 <0>[  167.303811] ---------------------------------
 <4>[  167.304722] ------------[ cut here ]------------
 <2>[  167.304725] kernel BUG at drivers/gpu/drm/i915/gt/intel_engine_pm.c:283!
 <4>[  167.304731] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
 <4>[  167.304734] CPU: 11 PID: 89 Comm: kworker/11:1 Tainted: G        W          6.8.0-rc2-CI_DRM_14193-gc655e0fd2804+ #1
 <4>[  167.304736] Hardware name: Intel Corporation Rocket Lake Client Platform/RocketLake S UDIMM 6L RVP, BIOS RKLSFWI1.R00.3173.A03.2204210138 04/21/2022
 <4>[  167.304738] Workqueue: i915-unordered retire_work_handler [i915]
 <4>[  167.304839] RIP: 0010:__engine_park+0x3fd/0x680 [i915]
 <4>[  167.304937] Code: 00 48 c7 c2 b0 e5 86 a0 48 8d 3d 00 00 00 00 e8 79 48 d4 e0 bf 01 00 00 00 e8 ef 0a d4 e0 31 f6 bf 09 00 00 00 e8 03 49 c0 e0 <0f> 0b 0f 0b be 01 00 00 00 e8 f5 61 fd ff 31 c0 e9 34 fd ff ff 48
 <4>[  167.304940] RSP: 0018:ffffc9000059fce0 EFLAGS: 00010246
 <4>[  167.304942] RAX: 0000000000000200 RBX: 0000000000000000 RCX: 0000000000000006
 <4>[  167.304944] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000009
 <4>[  167.304946] RBP: ffff8881330ca1b0 R08: 0000000000000001 R09: 0000000000000001
 <4>[  167.304947] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8881330ca000
 <4>[  167.304948] R13: ffff888110f02aa0 R14: ffff88812d1d0205 R15: ffff88811277d4f0
 <4>[  167.304950] FS:  0000000000000000(0000) GS:ffff88844f780000(0000) knlGS:0000000000000000
 <4>[  167.304952] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 <4>[  167.304953] CR2: 00007fc362200c40 CR3: 000000013306e003 CR4: 0000000000770ef0
 <4>[  167.304955] PKRU: 55555554
 <4>[  167.304957] Call Trace:
 <4>[  167.304958]  <TASK>
 <4>[  167.305573]  ____intel_wakeref_put_last+0x1d/0x80 [i915]
 <4>[  167.305685]  i915_request_retire.part.0+0x34f/0x600 [i915]
 <4>[  167.305800]  retire_requests+0x51/0x80 [i915]
 <4>[  167.305892]  intel_gt_retire_requests_timeout+0x27f/0x700 [i915]
 <4>[  167.305985]  process_scheduled_works+0x2db/0x530
 <4>[  167.305990]  worker_thread+0x18c/0x350
 <4>[  167.305993]  kthread+0xfe/0x130
 <4>[  167.305997]  ret_from_fork+0x2c/0x50
 <4>[  167.306001]  ret_from_fork_asm+0x1b/0x30
 <4>[  167.306004]  </TASK>

 It is necessary for the queue_priority_hint to be lower than the next
 request submission upon waking up, as we rely on the hint to decide when
 to kick the tasklet to submit that first request.

 (cherry picked from commit 98850e96cf811dc2d0a7d0af491caff9f5d49c1e)

 The Linux kernel CVE team has assigned CVE-2024-26937 to this issue.


 Affected and fixed versions
 ===========================

 	Issue introduced in 5.4 with commit 22b7a426bbe1ebe1520f92da4cd1617d1e1b5fc4 and fixed in 5.4.274 with commit 67944e6db656bf1e986aa2a359f866f851091f8a
 	Issue introduced in 5.4 with commit 22b7a426bbe1ebe1520f92da4cd1617d1e1b5fc4 and fixed in 5.10.215 with commit fe34587acc995e7b1d7a5d3444a0736721ec32b3
 	Issue introduced in 5.4 with commit 22b7a426bbe1ebe1520f92da4cd1617d1e1b5fc4 and fixed in 5.15.154 with commit ac9b6b3e8d1237136c8ebf0fa1ce037dd7e2948f
 	Issue introduced in 5.4 with commit 22b7a426bbe1ebe1520f92da4cd1617d1e1b5fc4 and fixed in 6.1.84 with commit 7eab7b021835ae422c38b968d5cc60e99408fb62
 	Issue introduced in 5.4 with commit 22b7a426bbe1ebe1520f92da4cd1617d1e1b5fc4 and fixed in 6.6.24 with commit 3b031e4fcb2740988143c303f81f69f18ce86325
 	Issue introduced in 5.4 with commit 22b7a426bbe1ebe1520f92da4cd1617d1e1b5fc4 and fixed in 6.7.12 with commit aed034866a08bb7e6e34d50a5629a4d23fe83703
 	Issue introduced in 5.4 with commit 22b7a426bbe1ebe1520f92da4cd1617d1e1b5fc4 and fixed in 6.8.3 with commit 8fd9b0ce8c26533fe4d5d15ea15bbf7b904b611c
 	Issue introduced in 5.4 with commit 22b7a426bbe1ebe1520f92da4cd1617d1e1b5fc4 and fixed in 6.9 with commit 4a3859ea5240365d21f6053ee219bb240d520895

 Please see https://www.kernel.org for a full list of currently supported
 kernel versions by the kernel community.

 Unaffected versions might change over time as fixes are backported to
 older supported kernel versions.  The official CVE entry at
 	https://cve.org/CVERecord/?id=CVE-2024-26937
 will be updated if fixes are backported, please check that for the most
 up to date information about this issue.


 Affected files
 ==============

 The file(s) affected by this issue are:
 	drivers/gpu/drm/i915/gt/intel_engine_pm.c
 	drivers/gpu/drm/i915/gt/intel_execlists_submission.c


 Mitigation
 ==========

 The Linux kernel CVE team recommends that you update to the latest
 stable kernel version for this, and many other bugfixes.  Individual
 changes are never tested alone, but rather are part of a larger kernel
 release.  Cherry-picking individual commits is not recommended or
 supported by the Linux kernel community at all.  If however, updating to
 the latest release is impossible, the individual changes to resolve this
 issue can be found at these commits:
 	https://git.kernel.org/stable/c/67944e6db656bf1e986aa2a359f866f851091f8a
 	https://git.kernel.org/stable/c/fe34587acc995e7b1d7a5d3444a0736721ec32b3
 	https://git.kernel.org/stable/c/ac9b6b3e8d1237136c8ebf0fa1ce037dd7e2948f
 	https://git.kernel.org/stable/c/7eab7b021835ae422c38b968d5cc60e99408fb62
 	https://git.kernel.org/stable/c/3b031e4fcb2740988143c303f81f69f18ce86325
 	https://git.kernel.org/stable/c/aed034866a08bb7e6e34d50a5629a4d23fe83703
 	https://git.kernel.org/stable/c/8fd9b0ce8c26533fe4d5d15ea15bbf7b904b611c
 	https://git.kernel.org/stable/c/4a3859ea5240365d21f6053ee219bb240d520895
	From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
	From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	To: <linux-cve-announce@vger.kernel.org>
	Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
	Subject: CVE-2024-26937: drm/i915/gt: Reset queue_priority_hint on parking

	Description
	===========

	In the Linux kernel, the following vulnerability has been resolved:

	drm/i915/gt: Reset queue_priority_hint on parking

	Originally, with strict in order execution, we could complete execution
	only when the queue was empty. Preempt-to-busy allows replacement of an
	active request that may complete before the preemption is processed by
	HW. If that happens, the request is retired from the queue, but the
	queue_priority_hint remains set, preventing direct submission until
	after the next CS interrupt is processed.

	This preempt-to-busy race can be triggered by the heartbeat, which will
	also act as the power-management barrier and upon completion allow us to
	idle the HW. We may process the completion of the heartbeat, and begin
	parking the engine before the CS event that restores the
	queue_priority_hint, causing us to fail the assertion that it is MIN.

	<3>[ 166.210729] __engine_park:283 GEM_BUG_ON(engine->sched_engine->queue_priority_hint != (-((int)(~0U >> 1)) - 1))
	<0>[ 166.210781] Dumping ftrace buffer:
	<0>[ 166.210795] ---------------------------------
	...
	<0>[ 167.302811] drm_fdin-1097 2..s1. 165741070us : trace_ports: 0000:00:02.0 rcs0: promote { ccid:20 1217:2 prio 0 }
	<0>[ 167.302861] drm_fdin-1097 2d.s2. 165741072us : execlists_submission_tasklet: 0000:00:02.0 rcs0: preempting last=1217:2, prio=0, hint=2147483646
	<0>[ 167.302928] drm_fdin-1097 2d.s2. 165741072us : __i915_request_unsubmit: 0000:00:02.0 rcs0: fence 1217:2, current 0
	<0>[ 167.302992] drm_fdin-1097 2d.s2. 165741073us : __i915_request_submit: 0000:00:02.0 rcs0: fence 3:4660, current 4659
	<0>[ 167.303044] drm_fdin-1097 2d.s1. 165741076us : execlists_submission_tasklet: 0000:00:02.0 rcs0: context:3 schedule-in, ccid:40
	<0>[ 167.303095] drm_fdin-1097 2d.s1. 165741077us : trace_ports: 0000:00:02.0 rcs0: submit { ccid:40 3:4660* prio 2147483646 }
	<0>[ 167.303159] kworker/-89 11..... 165741139us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence c90:2, current 2
	<0>[ 167.303208] kworker/-89 11..... 165741148us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:c90 unpin
	<0>[ 167.303272] kworker/-89 11..... 165741159us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 1217:2, current 2
	<0>[ 167.303321] kworker/-89 11..... 165741166us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:1217 unpin
	<0>[ 167.303384] kworker/-89 11..... 165741170us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 3:4660, current 4660
	<0>[ 167.303434] kworker/-89 11d..1. 165741172us : __intel_context_retire: 0000:00:02.0 rcs0: context:1216 retire runtime: { total:56028ns, avg:56028ns }
	<0>[ 167.303484] kworker/-89 11..... 165741198us : __engine_park: 0000:00:02.0 rcs0: parked
	<0>[ 167.303534] <idle>-0 5d.H3. 165741207us : execlists_irq_handler: 0000:00:02.0 rcs0: semaphore yield: 00000040
	<0>[ 167.303583] kworker/-89 11..... 165741397us : __intel_context_retire: 0000:00:02.0 rcs0: context:1217 retire runtime: { total:325575ns, avg:0ns }
	<0>[ 167.303756] kworker/-89 11..... 165741777us : __intel_context_retire: 0000:00:02.0 rcs0: context:c90 retire runtime: { total:0ns, avg:0ns }
	<0>[ 167.303806] kworker/-89 11..... 165742017us : __engine_park: __engine_park:283 GEM_BUG_ON(engine->sched_engine->queue_priority_hint != (-((int)(~0U >> 1)) - 1))
	<0>[ 167.303811] ---------------------------------
	<4>[ 167.304722] ------------[ cut here ]------------
	<2>[ 167.304725] kernel BUG at drivers/gpu/drm/i915/gt/intel_engine_pm.c:283!
	<4>[ 167.304731] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
	<4>[ 167.304734] CPU: 11 PID: 89 Comm: kworker/11:1 Tainted: G W 6.8.0-rc2-CI_DRM_14193-gc655e0fd2804+ #1
	<4>[ 167.304736] Hardware name: Intel Corporation Rocket Lake Client Platform/RocketLake S UDIMM 6L RVP, BIOS RKLSFWI1.R00.3173.A03.2204210138 04/21/2022
	<4>[ 167.304738] Workqueue: i915-unordered retire_work_handler [i915]
	<4>[ 167.304839] RIP: 0010:__engine_park+0x3fd/0x680 [i915]
	<4>[ 167.304937] Code: 00 48 c7 c2 b0 e5 86 a0 48 8d 3d 00 00 00 00 e8 79 48 d4 e0 bf 01 00 00 00 e8 ef 0a d4 e0 31 f6 bf 09 00 00 00 e8 03 49 c0 e0 <0f> 0b 0f 0b be 01 00 00 00 e8 f5 61 fd ff 31 c0 e9 34 fd ff ff 48
	<4>[ 167.304940] RSP: 0018:ffffc9000059fce0 EFLAGS: 00010246
	<4>[ 167.304942] RAX: 0000000000000200 RBX: 0000000000000000 RCX: 0000000000000006
	<4>[ 167.304944] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000009
	<4>[ 167.304946] RBP: ffff8881330ca1b0 R08: 0000000000000001 R09: 0000000000000001
	<4>[ 167.304947] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8881330ca000
	<4>[ 167.304948] R13: ffff888110f02aa0 R14: ffff88812d1d0205 R15: ffff88811277d4f0
	<4>[ 167.304950] FS: 0000000000000000(0000) GS:ffff88844f780000(0000) knlGS:0000000000000000
	<4>[ 167.304952] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	<4>[ 167.304953] CR2: 00007fc362200c40 CR3: 000000013306e003 CR4: 0000000000770ef0
	<4>[ 167.304955] PKRU: 55555554
	<4>[ 167.304957] Call Trace:
	<4>[ 167.304958] <TASK>
	<4>[ 167.305573] ____intel_wakeref_put_last+0x1d/0x80 [i915]
	<4>[ 167.305685] i915_request_retire.part.0+0x34f/0x600 [i915]
	<4>[ 167.305800] retire_requests+0x51/0x80 [i915]
	<4>[ 167.305892] intel_gt_retire_requests_timeout+0x27f/0x700 [i915]
	<4>[ 167.305985] process_scheduled_works+0x2db/0x530
	<4>[ 167.305990] worker_thread+0x18c/0x350
	<4>[ 167.305993] kthread+0xfe/0x130
	<4>[ 167.305997] ret_from_fork+0x2c/0x50
	<4>[ 167.306001] ret_from_fork_asm+0x1b/0x30
	<4>[ 167.306004] </TASK>

	It is necessary for the queue_priority_hint to be lower than the next
	request submission upon waking up, as we rely on the hint to decide when
	to kick the tasklet to submit that first request.

	(cherry picked from commit 98850e96cf811dc2d0a7d0af491caff9f5d49c1e)

	The Linux kernel CVE team has assigned CVE-2024-26937 to this issue.


	Affected and fixed versions
	===========================

	Issue introduced in 5.4 with commit 22b7a426bbe1ebe1520f92da4cd1617d1e1b5fc4 and fixed in 5.4.274 with commit 67944e6db656bf1e986aa2a359f866f851091f8a
	Issue introduced in 5.4 with commit 22b7a426bbe1ebe1520f92da4cd1617d1e1b5fc4 and fixed in 5.10.215 with commit fe34587acc995e7b1d7a5d3444a0736721ec32b3
	Issue introduced in 5.4 with commit 22b7a426bbe1ebe1520f92da4cd1617d1e1b5fc4 and fixed in 5.15.154 with commit ac9b6b3e8d1237136c8ebf0fa1ce037dd7e2948f
	Issue introduced in 5.4 with commit 22b7a426bbe1ebe1520f92da4cd1617d1e1b5fc4 and fixed in 6.1.84 with commit 7eab7b021835ae422c38b968d5cc60e99408fb62
	Issue introduced in 5.4 with commit 22b7a426bbe1ebe1520f92da4cd1617d1e1b5fc4 and fixed in 6.6.24 with commit 3b031e4fcb2740988143c303f81f69f18ce86325
	Issue introduced in 5.4 with commit 22b7a426bbe1ebe1520f92da4cd1617d1e1b5fc4 and fixed in 6.7.12 with commit aed034866a08bb7e6e34d50a5629a4d23fe83703
	Issue introduced in 5.4 with commit 22b7a426bbe1ebe1520f92da4cd1617d1e1b5fc4 and fixed in 6.8.3 with commit 8fd9b0ce8c26533fe4d5d15ea15bbf7b904b611c
	Issue introduced in 5.4 with commit 22b7a426bbe1ebe1520f92da4cd1617d1e1b5fc4 and fixed in 6.9 with commit 4a3859ea5240365d21f6053ee219bb240d520895

	Please see https://www.kernel.org for a full list of currently supported
	kernel versions by the kernel community.

	Unaffected versions might change over time as fixes are backported to
	older supported kernel versions. The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-26937
	will be updated if fixes are backported, please check that for the most
	up to date information about this issue.


	Affected files
	==============

	The file(s) affected by this issue are:
	drivers/gpu/drm/i915/gt/intel_engine_pm.c
	drivers/gpu/drm/i915/gt/intel_execlists_submission.c


	Mitigation
	==========

	The Linux kernel CVE team recommends that you update to the latest
	stable kernel version for this, and many other bugfixes. Individual
	changes are never tested alone, but rather are part of a larger kernel
	release. Cherry-picking individual commits is not recommended or
	supported by the Linux kernel community at all. If however, updating to
	the latest release is impossible, the individual changes to resolve this
	issue can be found at these commits:
	https://git.kernel.org/stable/c/67944e6db656bf1e986aa2a359f866f851091f8a
	https://git.kernel.org/stable/c/fe34587acc995e7b1d7a5d3444a0736721ec32b3
	https://git.kernel.org/stable/c/ac9b6b3e8d1237136c8ebf0fa1ce037dd7e2948f
	https://git.kernel.org/stable/c/7eab7b021835ae422c38b968d5cc60e99408fb62
	https://git.kernel.org/stable/c/3b031e4fcb2740988143c303f81f69f18ce86325
	https://git.kernel.org/stable/c/aed034866a08bb7e6e34d50a5629a4d23fe83703
	https://git.kernel.org/stable/c/8fd9b0ce8c26533fe4d5d15ea15bbf7b904b611c
	https://git.kernel.org/stable/c/4a3859ea5240365d21f6053ee219bb240d520895