In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/xe\/pt: Reset current_op in xe_pt_update_ops_init()<\/p>\n
xe_pt_update_ops_init() fails to reset current_op to 0. On the
\nvm_bind path, ops_execute() calls xe_pt_update_ops_prepare() inside
\nthe xe_validation_guard() \/ drm_exec_until_all_locked() loop. When
\nthat loop retries due to lock contention or OOM eviction
\n(drm_exec_retry_on_contention() \/ xe_validation_retry_on_oom()),
\nxe_pt_update_ops_prepare() runs again on the same vops, and each
\ncall to bind_op_prepare() increments current_op without resetting it.<\/p>\n
After N retries current_op exceeds the array size allocated by
\nxe_vma_ops_alloc(), causing an out-of-bounds write into
\nSLUB-poisoned memory and a subsequent UAF crash in
\nxe_migrate_update_pgtables_cpu() when reading the corrupted pt_op->bind.<\/p>\n
Also reset needs_svm_lock and needs_invalidation which are derived in
\nthe same prepare pass and would otherwise cause wrong migrate ops
\nselection and redundant TLB invalidation on retry.<\/p>\n
Fix this by resetting current_op, needs_svm_lock and needs_invalidation
\nin xe_pt_update_ops_init().<\/p>\n
v2 (Matt):
\n – Add details in commit message.
\n – Add Fixes tag and Cc to stable@vger.kernel.org<\/p>\n
(cherry picked from commit 046045543e530605c441063535e7dca0075369a6)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/xe\/pt: Reset current_op in xe_pt_update_ops_init()<\/p>\n
xe_pt_update_ops_init() fails to reset current_op to 0. On the
\nvm_bind path<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5403","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5403","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5403"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5403"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5403"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}