In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/xe\/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create()<\/p>\n
Commit 9e9787414882 (“drm\/xe\/userptr: replace xe_hmm with gpusvm”) made
\nxe_svm_init() unconditional in xe_vm_create() and extended it to also
\ninitialize a “simple” gpusvm state for non-fault-mode VMs. The matching
\nxe_svm_fini() call in xe_vm_close_and_put() was updated to run
\nunconditionally, but the error unwind path in xe_vm_create() was not.<\/p>\n
On the drm_gpuvm_resv_object_alloc() failure path, xe_svm_init() has
\nalready succeeded but xe_svm_fini() is only called when
\nXE_VM_FLAG_FAULT_MODE is set. For non-fault-mode VMs this leaves
\nvm->svm.gpusvm partially initialized and leaks the resources allocated
\nby drm_gpusvm_init().<\/p>\n
For fault-mode VMs, xe_svm_init() additionally acquires the pagemap
\nowner via drm_pagemap_acquire_owner() and the pagemaps via
\nxe_svm_get_pagemaps(). Those resources are released by xe_svm_close(),
\nnot xe_svm_fini(). On the same error path, xe_svm_close() is not
\ncalled either, so fault-mode VMs leak the pagemap owner and pagemaps.<\/p>\n
Fix both leaks:<\/p>\n
– Call xe_svm_fini() unconditionally on the err_svm_fini path, matching
\n the unconditional xe_svm_init() call. Move the vm->size = 0
\n assignment out of the conditional so the xe_vm_is_closed() assert in
\n xe_svm_fini() (and xe_svm_close()) holds for both modes.<\/p>\n
– Call xe_svm_close() for fault-mode VMs before xe_svm_fini(), matching
\n the ordering used in xe_vm_close_and_put().<\/p>\n
(cherry picked from commit ca2a3587d577ba764e0fe628fb676244fc33ddd4)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/xe\/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create()<\/p>\n
Commit 9e9787414882 (“drm\/xe\/userptr: replace xe_hmm with gpus<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5416","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5416","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5416"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5416"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5416"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}