drm/i915/ttm: fix CCS handling

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/i915/ttm: fix CCS handling Crucible + recent Mesa seems to sometimes hit: GEM_BUG_ON(num_ccs_blks > NUM_CCS_BLKS_PER_XFER) And it looks like we can also trigger this with gem_lmem_swapping, if we modify the test to use slightly larger object sizes. Looking closer it looks like we have the following issues in migrate_copy(): • We are using plain integer in various places, which we can easily overflow with a large object. • We pass the entire object size (when the src is lmem) into emit_pte() and then try to copy it, which doesn't work, since we only have a few fixed sized windows in which to map the pages and perform the copy. With an object > 8M we therefore aren't properly copying the pages. And then with an object > 64M we trigger the GEM_BUG_ON(num_ccs_blks > NUM_CCS_BLKS_PER_XFER). So it looks like our copy handling for any object > 8M (which is our CHUNK_SZ) is currently broken on DG2. Testcase: igt@gem_lmem_swapping (cherry picked from commit 8676145eb2f53a9940ff70910caf0125bd8a4bc2)

Timeline

1. Jun 18, 2025, 11:00 AM UTCCVE published
2. Oct 15, 2026, 9:29 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 15, 2026, 9:31 PM UTCRecord last updated

Affected versions

• Linux Linux

  From da0595ae91da837929a00470ab40546090e5b9ae · fixed in 97434cb55bd884bd268626ec41489f79b261b2d4; From da0595ae91da837929a00470ab40546090e5b9ae · fixed in 8d905254162965c8e6be697d82c7dbf5d08f574d

• Linux Linux

  5.19

• KernelLinux

  From 5.19.0 · fixed in 5.19.8

References 2