In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/xe\/pt: prevent invalid cursor access for purged BOs<\/p>\n
During a page table walk for binding, xe_pt_stage_bind() explicitly
\nskips initializing the xe_res_cursor for purged BOs, treating them
\nsimilarly to NULL VMAs by only setting the cursor size.<\/p>\n
However, xe_pt_hugepte_possible() and xe_pt_scan_64K() did not check
\nif the BO was purged before attempting to walk the cursor using
\nxe_res_dma() and xe_res_next(). Because the cursor was left
\nuninitialized for purged BOs, this falls through and triggers
\nwarnings like:<\/p>\n
WARNING: drivers\/gpu\/drm\/xe\/xe_res_cursor.h:274 at xe_res_next<\/p>\n
Fix this by explicitly checking if the BO is purged in both
\nxe_pt_hugepte_possible() and xe_pt_scan_64K(), returning early just
\nas we do for NULL VMAs, avoiding the invalid cursor accesses entirely.<\/p>\n
As a precaution, also zero-initialize the cursor in xe_pt_stage_bind()
\nto ensure we don’t pass garbage data into the page table walkers
\nif we ever hit a similar edge case in the future.<\/p>\n
(cherry picked from commit 4c7b9c6ece32440e5a435a92076d049450cd2d2e)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/xe\/pt: prevent invalid cursor access for purged BOs<\/p>\n
During a page table walk for binding, xe_pt_stage_bind() explicitly
\nskips <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6997","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6997","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6997"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6997"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6997"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}