In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/xe\/vm: nuke PTs only after unlinking contested VMAs<\/p>\n
In xe_vm_close_and_put(), external-BO VMAs are queued on the contested
\nlist for deferred destruction via xe_vma_destroy_unlocked(). However,
\nxe_vm_pt_destroy() was previously invoked before processing contested
\nVMAs, destroying vm->pt_root while those VMAs were still linked to their
\nrespective buffer objects (vm_bo->list.gpuva).<\/p>\n
If a concurrent thread evicts one of those shared buffer objects,
\nxe_bo_trigger_rebind() holding only bo->resv walks the BO’s VMAs and, in
\nfault mode, calls xe_vm_invalidate_vma() -> xe_pt_zap_ptes(). Because
\nvm->pt_root[tile->id] is already NULL, dereferencing pt->level causes a
\nNULL ptr deref.<\/p>\n
Fix this by deferring xe_vm_free_scratch() and xe_vm_pt_destroy() until
\nafter all contested VMAs have been unlinked and destroyed.<\/p>\n
User is reporting hitting a NULL ptr deref in xe_pt_zap_ptes(), which
\ncould be explained by this race.<\/p>\n
(cherry picked from commit c2863648959489767f08892fd6e90577d2ea0b6a)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/xe\/vm: nuke PTs only after unlinking contested VMAs<\/p>\n
In xe_vm_close_and_put(), external-BO VMAs are queued on the contested
\nlis<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-40982","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/40982","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40982"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40982"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40982"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}