drm/xe: Wait on external BO kernel fences in exec IOCTL
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.103, 6.18.44, 7.1.8
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xe_exec_ioctl() only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs, but not external BOs (bo->vm == NULL), which carry their kernel operations (evictions, moves, ...) in their own dma-resv KERNEL slot. The DMA_RESV_USAGE_KERNEL slot is the cross-driver contract for memory management operations that must complete before the BO or its backing store may be used: any accessor is required to wait on the KERNEL fences before touching the resv. By skipping the external BOs' KERNEL slots, the exec path violated that contract and could schedule a user job while a kernel operation on an external BO mapped by the VM was still in flight, racing against it and potentially reading or writing memory that was being moved. Replace the VM-only dependency with an iteration over every object locked by the exec, adding each object's KERNEL slot as a job dependency. This covers the VM resv (rebinds and private BOs) as well as every external BO, mirroring the drm_gpuvm_resv_add_fence() call that later publishes the job fence to the same set of objects. Long-running mode continues to skip this, as before. (cherry picked from commit a6b842acf3ddd1efc53a56de9260cfa718fb35e7)
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From dd08ebf6c3525a7ea2186e636df064ea47281987 · fixed in 1738db550334adca0e7fcf0ef684198fb7462779; From dd08ebf6c3525a7ea2186e636df064ea47281987 · fixed in 21976fe5258494ac38b63d103be81bf1180ae4ae; From dd08ebf6c3525a7ea2186e636df064ea47281987 · fixed in 5d363d00bc9799b90a0dc89eb1c5dcb909c042ee; From dd08ebf6c3525a7ea2186e636df064ea47281987 · fixed in af80e2bfde9312c76b60cf9274248dce0410b30d
- Linux Linux
6.8
- KernelLinux
From 6.8.0 · fixed in 6.12.103; From 6.13.0 · fixed in 6.18.44; From 6.19.0 · fixed in 7.1.8