In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()<\/p>\n
Map failure from pvr_mmu_map_sgl() interface was not returned correctly
\nto pvr_mmu_map() interface. This resulted in pvr_mmu_map() interface to
\ncontinue instead of returning an error to caller.
\nFix it by returning a proper error code from pvr_mmu_map_sgl() interface.<\/p>\n
Call stack for crash:
\n[ 1179.286237] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
\n[ 1179.295067] Mem abort info:
\n[ 1179.297877] ESR = 0x0000000096000004
\n[ 1179.301656] EC = 0x25: DABT (current EL), IL = 32 bits
\n[ 1179.306987] SET = 0, FnV = 0
\n[ 1179.310048] EA = 0, S1PTW = 0
\n[ 1179.313198] FSC = 0x04: level 0 translation fault
\n[ 1179.318096] Data abort info:
\n[ 1179.320993] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
\n[ 1179.326483] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
\n[ 1179.331546] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
\n[ 1179.336895] user pgtable: 4k pages, 48-bit VAs, pgdp=000000009822a000
\n[ 1179.343402] [0000000000000008] pgd=0000000000000000, p4d=0000000000000000
\n[ 1179.350243] Internal error: Oops: 0000000096000004 [#2] SMP
\n[ 1179.355908] Modules linked in: powervr gpu_sched drm_shmem_helper drm_gpuvm drm_exec xhci_plat_hcd xhci_hcd dwc3 usbcore usb_common snd_soc_simple_card snd_soc_simple_card_utils dwc3_am62 at24 sa2ul sha512 libsha512 sha256 authenc sch_fq_codel fuse dm_mod ipv6
\n[ 1179.378992] CPU: 1 UID: 1000 PID: 680 Comm: deqp-vk Tainted: G D 6.17.0 #1 PREEMPT
\n[ 1179.388120] Tainted: [D]=DIE
\n[ 1179.390994] Hardware name: Texas Instruments AM625 SK (DT)
\n[ 1179.396467] pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=–)
\n[ 1179.403415] pc : pvr_mmu_op_context_unmap_curr_page+0x6c\/0x134 [powervr]
\n[ 1179.410140] lr : pvr_mmu_op_context_unmap_curr_page+0x58\/0x134 [powervr]
\n[ 1179.416848] sp : ffff8000839ab8c0
\n[ 1179.420153] x29: ffff8000839ab8c0 x28: 0000000000000001 x27: 000000008f386000
\n[ 1179.427283] x26: ffff000016d1df98 x25: 0000000000247000 x24: 00000000000001e6
\n[ 1179.434413] x23: 0000000000000002 x22: 000000000000ffff x21: 0000000000000247
\n[ 1179.441540] x20: 0000000000000245 x19: ffff000016d1df60 x18: 0000000000000002
\n[ 1179.448668] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001
\n[ 1179.455793] x14: 0000000000060810 x13: ffff80007fffffff x12: ffff000004190480
\n[ 1179.462921] x11: ffff8000853f7000 x10: ffff8000811ae000 x9 : ffff0000041900b8
\n[ 1179.470051] x8 : 0000000000000000 x7 : 00000000990c4001 x6 : 0000000000000007
\n[ 1179.477177] x5 : ffff000016d1df60 x4 : 0000000000000000 x3 : ffff00000a7d8000
\n[ 1179.484306] x2 : 00000000000001ff x1 : 0000000000000000 x0 : 0000000000000000
\n[ 1179.491433] Call trace:
\n[ 1179.493872] pvr_mmu_op_context_unmap_curr_page+0x6c\/0x134 [powervr] (P)
\n[ 1179.500582] pvr_mmu_map+0x31c\/0x388 [powervr]
\n[ 1179.505027] pvr_vm_gpuva_map+0x40\/0x88 [powervr]
\n[ 1179.509732] __drm_gpuvm_sm_map+0x250\/0x44c [drm_gpuvm]
\n[ 1179.514952] drm_gpuvm_sm_map+0x48\/0x5c [drm_gpuvm]
\n[ 1179.519822] pvr_vm_bind_op_exec+0x64\/0x70 [powervr]
\n[ 1179.524785] pvr_vm_map+0x1f8\/0x2a8 [powervr]
\n[ 1179.529142] pvr_ioctl_vm_map+0x12c\/0x188 [powervr]
\n[ 1179.534018] drm_ioctl_kernel+0xb8\/0x128
\n[ 1179.537941] drm_ioctl+0x21c\/0x4ec
\n[ 1179.541337] __arm64_sys_ioctl+0xac\/0x108
\n[ 1179.545344] invoke_syscall+0x44\/0x100
\n[ 1179.549091] el0_svc_common.constprop.0+0x40\/0xe0
\n[ 1179.553790] do_el0_svc+0x1c\/0x28
\n[ 1179.557106] el0_svc+0x34\/0xf0
\n[ 1179.560159] el0t_64_sync_handler+0xd0\/0xe4
\n[ 1179.564334] el0t_64_sync+0x198\/0x19c
\n[ 1179.567996] Code: 54000300 35000360 f9402261 79409a62 (f9400421)
\n[ 1179.574081] —[ end trace 0000000000000000 ]—<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()<\/p>\n
Map failure from pvr_mmu_map_sgl() interface was not retu<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-40994","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/40994","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40994"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40994"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40994"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}