CVE-2024-53116

drm/panthor: Fix handling of partial GPU mapping of BOs

Medium · published December 2, 2024

CVSS v3.1
5.5
EPSS
0%
Percentile
9.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: Fix handling of partial GPU mapping of BOs

This commit fixes the bug in the handling of partial mapping of the

buffer objects to the GPU, which caused kernel warnings.

Panthor didn't correctly handle the case where the partial mapping

spanned multiple scatterlists and the mapping offset didn't point

to the 1st page of starting scatterlist. The offset variable was

not cleared after reaching the starting scatterlist.

Following warning messages were seen.

WARNING: CPU: 1 PID: 650 at drivers/iommu/io-pgtable-arm.c:659 __arm_lpae_unmap+0x254/0x5a0

<snip>

pc : __arm_lpae_unmap+0x254/0x5a0

lr : __arm_lpae_unmap+0x2cc/0x5a0

<snip>

Call trace:

__arm_lpae_unmap+0x254/0x5a0

__arm_lpae_unmap+0x108/0x5a0

__arm_lpae_unmap+0x108/0x5a0

__arm_lpae_unmap+0x108/0x5a0

arm_lpae_unmap_pages+0x80/0xa0

panthor_vm_unmap_pages+0xac/0x1c8 [panthor]

panthor_gpuva_sm_step_unmap+0x4c/0xc8 [panthor]

op_unmap_cb.isra.23.constprop.30+0x54/0x80

__drm_gpuvm_sm_unmap+0x184/0x1c8

drm_gpuvm_sm_unmap+0x40/0x60

panthor_vm_exec_op+0xa8/0x120 [panthor]

panthor_vm_bind_exec_sync_op+0xc4/0xe8 [panthor]

panthor_ioctl_vm_bind+0x10c/0x170 [panthor]

drm_ioctl_kernel+0xbc/0x138

drm_ioctl+0x210/0x4b0

__arm64_sys_ioctl+0xb0/0xf8

invoke_syscall+0x4c/0x110

el0_svc_common.constprop.1+0x98/0xf8

do_el0_svc+0x24/0x38

el0_svc+0x34/0xc8

el0t_64_sync_handler+0xa0/0xc8

el0t_64_sync+0x174/0x178

<snip>

panthor : [drm] drm_WARN_ON(unmapped_sz != pgsize * pgcount)

WARNING: CPU: 1 PID: 650 at drivers/gpu/drm/panthor/panthor_mmu.c:922 panthor_vm_unmap_pages+0x124/0x1c8 [panthor]

<snip>

pc : panthor_vm_unmap_pages+0x124/0x1c8 [panthor]

lr : panthor_vm_unmap_pages+0x124/0x1c8 [panthor]

<snip>

panthor : [drm] *ERROR* failed to unmap range ffffa388f000-ffffa3890000 (requested range ffffa388c000-ffffa3890000)

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00202 · 9.6th percentile
Published
2024-12-02T13:44Z
EPSS history
Timeline
  • 02 DEC 13:44Z
    drm/panthor: Fix handling of partial GPU mapping of BOs
    cvelistv5