In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/amdgpu: reject oversized IBs with per-ring packet limits<\/p>\n
On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through
\nto ib->length_dw without a limit, while ring_emit_ib() encodes length
\ninto packet fields. Oversized values can corrupt adjacent control bits
\nand destabilize command submission.<\/p>\n
Add a per-ring IB packet size limit helper and reject command
\nsubmissions exceeding the corresponding dword limit before IB
\nallocation. Use the documented 20-bit limit for GFX\/compute\/SDMA\/VPE,
\nand apply the MM fallback limit for other ring types.<\/p>\n
(cherry picked from commit 7f48fa2cf62e3fa6c9c3870aa74988f773247e52)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/amdgpu: reject oversized IBs with per-ring packet limits<\/p>\n
On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11974","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11974","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11974"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11974"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11974"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}