| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-53116: drm/panthor: Fix handling of partial GPU mapping of BOs |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| drm/panthor: Fix handling of partial GPU mapping of BOs |
| |
| This commit fixes the bug in the handling of partial mapping of the |
| buffer objects to the GPU, which caused kernel warnings. |
| |
| Panthor didn't correctly handle the case where the partial mapping |
| spanned multiple scatterlists and the mapping offset didn't point |
| to the 1st page of starting scatterlist. The offset variable was |
| not cleared after reaching the starting scatterlist. |
| |
| Following warning messages were seen. |
| WARNING: CPU: 1 PID: 650 at drivers/iommu/io-pgtable-arm.c:659 __arm_lpae_unmap+0x254/0x5a0 |
| <snip> |
| pc : __arm_lpae_unmap+0x254/0x5a0 |
| lr : __arm_lpae_unmap+0x2cc/0x5a0 |
| <snip> |
| Call trace: |
| __arm_lpae_unmap+0x254/0x5a0 |
| __arm_lpae_unmap+0x108/0x5a0 |
| __arm_lpae_unmap+0x108/0x5a0 |
| __arm_lpae_unmap+0x108/0x5a0 |
| arm_lpae_unmap_pages+0x80/0xa0 |
| panthor_vm_unmap_pages+0xac/0x1c8 [panthor] |
| panthor_gpuva_sm_step_unmap+0x4c/0xc8 [panthor] |
| op_unmap_cb.isra.23.constprop.30+0x54/0x80 |
| __drm_gpuvm_sm_unmap+0x184/0x1c8 |
| drm_gpuvm_sm_unmap+0x40/0x60 |
| panthor_vm_exec_op+0xa8/0x120 [panthor] |
| panthor_vm_bind_exec_sync_op+0xc4/0xe8 [panthor] |
| panthor_ioctl_vm_bind+0x10c/0x170 [panthor] |
| drm_ioctl_kernel+0xbc/0x138 |
| drm_ioctl+0x210/0x4b0 |
| __arm64_sys_ioctl+0xb0/0xf8 |
| invoke_syscall+0x4c/0x110 |
| el0_svc_common.constprop.1+0x98/0xf8 |
| do_el0_svc+0x24/0x38 |
| el0_svc+0x34/0xc8 |
| el0t_64_sync_handler+0xa0/0xc8 |
| el0t_64_sync+0x174/0x178 |
| <snip> |
| panthor : [drm] drm_WARN_ON(unmapped_sz != pgsize * pgcount) |
| WARNING: CPU: 1 PID: 650 at drivers/gpu/drm/panthor/panthor_mmu.c:922 panthor_vm_unmap_pages+0x124/0x1c8 [panthor] |
| <snip> |
| pc : panthor_vm_unmap_pages+0x124/0x1c8 [panthor] |
| lr : panthor_vm_unmap_pages+0x124/0x1c8 [panthor] |
| <snip> |
| panthor : [drm] *ERROR* failed to unmap range ffffa388f000-ffffa3890000 (requested range ffffa388c000-ffffa3890000) |
| |
| The Linux kernel CVE team has assigned CVE-2024-53116 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.10 with commit 647810ec247641eb5aec8caef818919a4518a0b1 and fixed in 6.11.10 with commit d3e61af64b770e0038470c81f42bd1d0598f6bcc |
| Issue introduced in 6.10 with commit 647810ec247641eb5aec8caef818919a4518a0b1 and fixed in 6.12 with commit 3387e043918e154ca08d83954966a8b087fe2835 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-53116 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/gpu/drm/panthor/panthor_mmu.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/d3e61af64b770e0038470c81f42bd1d0598f6bcc |
| https://git.kernel.org/stable/c/3387e043918e154ca08d83954966a8b087fe2835 |
