Skip to content

Commit ac83b16

Browse files
committed
drm/i915/dpt: Make DPT object unshrinkable
jira LE-3201 cve CVE-2024-40924 Rebuild_History Non-Buildable kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 commit-author Vidya Srinivas <vidya.srinivas@intel.com> commit 51064d4 In some scenarios, the DPT object gets shrunk but the actual framebuffer did not and thus its still there on the DPT's vm->bound_list. Then it tries to rewrite the PTEs via a stale CPU mapping. This causes panic. Cc: stable@vger.kernel.org Reported-by: Shawn Lee <shawn.c.lee@intel.com> Fixes: 0dc987b ("drm/i915/display: Add smem fallback allocation for dpt") Signed-off-by: Vidya Srinivas <vidya.srinivas@intel.com> [vsyrjala: Add TODO comment] Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240520165634.1162470-1-vidya.srinivas@intel.com (cherry picked from commit 51064d4) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
1 parent b4d59d2 commit ac83b16

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

drivers/gpu/drm/i915/gem/i915_gem_object.h

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -280,7 +280,9 @@ bool i915_gem_object_has_iomem(const struct drm_i915_gem_object *obj);
280280
static inline bool
281281
i915_gem_object_is_shrinkable(const struct drm_i915_gem_object *obj)
282282
{
283-
return i915_gem_object_type_has(obj, I915_GEM_OBJECT_IS_SHRINKABLE);
283+
/* TODO: make DPT shrinkable when it has no bound vmas */
284+
return i915_gem_object_type_has(obj, I915_GEM_OBJECT_IS_SHRINKABLE) &&
285+
!obj->is_dpt;
284286
}
285287

286288
static inline bool

0 commit comments

Comments
 (0)