CVE-2024-53116

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/panthor: Fix handling of partial GPU mapping of BOs<br /> <br /> This commit fixes the bug in the handling of partial mapping of the<br /> buffer objects to the GPU, which caused kernel warnings.<br /> <br /> Panthor didn&amp;#39;t correctly handle the case where the partial mapping<br /> spanned multiple scatterlists and the mapping offset didn&amp;#39;t point<br /> to the 1st page of starting scatterlist. The offset variable was<br /> not cleared after reaching the starting scatterlist.<br /> <br /> Following warning messages were seen.<br /> WARNING: CPU: 1 PID: 650 at drivers/iommu/io-pgtable-arm.c:659 __arm_lpae_unmap+0x254/0x5a0<br /> <br /> pc : __arm_lpae_unmap+0x254/0x5a0<br /> lr : __arm_lpae_unmap+0x2cc/0x5a0<br /> <br /> Call trace:<br /> __arm_lpae_unmap+0x254/0x5a0<br /> __arm_lpae_unmap+0x108/0x5a0<br /> __arm_lpae_unmap+0x108/0x5a0<br /> __arm_lpae_unmap+0x108/0x5a0<br /> arm_lpae_unmap_pages+0x80/0xa0<br /> panthor_vm_unmap_pages+0xac/0x1c8 [panthor]<br /> panthor_gpuva_sm_step_unmap+0x4c/0xc8 [panthor]<br /> op_unmap_cb.isra.23.constprop.30+0x54/0x80<br /> __drm_gpuvm_sm_unmap+0x184/0x1c8<br /> drm_gpuvm_sm_unmap+0x40/0x60<br /> panthor_vm_exec_op+0xa8/0x120 [panthor]<br /> panthor_vm_bind_exec_sync_op+0xc4/0xe8 [panthor]<br /> panthor_ioctl_vm_bind+0x10c/0x170 [panthor]<br /> drm_ioctl_kernel+0xbc/0x138<br /> drm_ioctl+0x210/0x4b0<br /> __arm64_sys_ioctl+0xb0/0xf8<br /> invoke_syscall+0x4c/0x110<br /> el0_svc_common.constprop.1+0x98/0xf8<br /> do_el0_svc+0x24/0x38<br /> el0_svc+0x34/0xc8<br /> el0t_64_sync_handler+0xa0/0xc8<br /> el0t_64_sync+0x174/0x178<br /> <br /> panthor : [drm] drm_WARN_ON(unmapped_sz != pgsize * pgcount)<br /> WARNING: CPU: 1 PID: 650 at drivers/gpu/drm/panthor/panthor_mmu.c:922 panthor_vm_unmap_pages+0x124/0x1c8 [panthor]<br /> <br /> pc : panthor_vm_unmap_pages+0x124/0x1c8 [panthor]<br /> lr : panthor_vm_unmap_pages+0x124/0x1c8 [panthor]<br /> <br /> panthor : [drm] *ERROR* failed to unmap range ffffa388f000-ffffa3890000 (requested range ffffa388c000-ffffa3890000)