CVE-2026-68437

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/imagination: Fit paired fragment job in the correct CCCB<br /> <br /> For geometry jobs with a paired fragment job, at the moment, the<br /> DRM scheduler&amp;#39;s prepare_job() callback:<br /> <br /> - checks for internal (driver) dependencies for the geometry job;<br /> - calls into pvr_queue_get_paired_frag_job_dep() to check for external<br /> dependencies for the fragment job (the two jobs are submitted together<br /> but the common scheduler code doesn&amp;#39;t know about it, so this needs to<br /> be done at this point in time);<br /> - calls into the prepare_job() callback again, but for the fragment job,<br /> to check its internal dependencies as well, passing the fragment job&amp;#39;s<br /> drm_sched_job and the geometry job&amp;#39;s drm_sched_entity / pvr_queue.<br /> <br /> The problem with the last step is that pvr_queue_prepare_job() doesn&amp;#39;t<br /> always take the mismatched fragment job and geometry queue into account,<br /> in particular when checking whether there is space for the fragment<br /> command to be submitted, so the code ends up checking for space in the<br /> geometry (i.e. wrong) CCCB.<br /> The rest of the nested prepare_job() callback happens to work fine at<br /> the moment as the other internal dependencies are not relevant for a<br /> paired fragment job.<br /> <br /> Move the initialisation of a paired fragment job&amp;#39;s done fence and CCCB<br /> fence to pvr_queue_get_paired_frag_job_dep(), inferring the correct<br /> queue from the fragment job itself.<br /> <br /> This fixes cases where prepare_job() wrongly assumed that there was<br /> enough space for a paired fragment job in its own CCCB, unblocking<br /> run_job(), which then returned early without writing the full sequence<br /> of commands to the CCCB.<br /> <br /> The above lead to kernel warnings such as the following and potentially<br /> job timeouts (depending on waiters on the missing commands):<br /> <br /> [ 552.421075] WARNING: drivers/gpu/drm/imagination/pvr_cccb.c:178 at pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr], CPU#2: kworker/u16:5/63<br /> [ 552.421230] Modules linked in:<br /> [ 552.421592] CPU: 2 UID: 0 PID: 63 Comm: kworker/u16:5 Tainted: G W 7.0.0-rc2-gc5d053e4dccb #39 PREEMPT<br /> [ 552.421625] Tainted: [W]=WARN<br /> [ 552.421637] Hardware name: Texas Instruments AM625 SK (DT)<br /> [ 552.421655] Workqueue: powervr-sched drm_sched_run_job_work [gpu_sched]<br /> [ 552.421744] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)<br /> [ 552.421766] pc : pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr]<br /> [ 552.421850] lr : pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr]<br /> [ 552.421923] sp : ffff800084c47650<br /> [ 552.421936] x29: ffff800084c47740 x28: 0000000000000df8 x27: ffff800088a77000<br /> [ 552.421979] x26: 0000000000000030 x25: ffff800084c47680 x24: 0000000000001000<br /> [ 552.422017] x23: ffff800084c47820 x22: 1ffff00010988ecc x21: 0000000000000008<br /> [ 552.422055] x20: 0000000000000208 x19: ffff000006ad5a88 x18: 0000000000000000<br /> [ 552.422093] x17: 0000000020020000 x16: 0000000000020000 x15: 0000000000000000<br /> [ 552.422130] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000<br /> [ 552.422167] x11: 000000000000f2f2 x10: 00000000f3000000 x9 : 00000000f3f3f3f3<br /> [ 552.422204] x8 : 00000000f2f2f200 x7 : ffff700010988ecc x6 : 0000000000000008<br /> [ 552.422241] x5 : 0000000000000000 x4 : 1ffff0001114ee00 x3 : 0000000000000000<br /> [ 552.422278] x2 : 0000000000000007 x1 : 0000000000000fff x0 : 000000000000002f<br /> [ 552.422316] Call trace:<br /> [ 552.422330] pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] (P)<br /> [ 552.422411] pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr]<br /> [ 552.422486] pvr_queue_run_job+0x3a4/0x990 [powervr]<br /> [ 552.422562] drm_sched_run_job_work+0x580/0xd48 [gpu_sched]<br /> [ 552.422623] process_one_work+0x520/0x1288<br /> [ 552.422657] worker_thread+0x3f0/0xb3c<br /> [ 552.422679] kthread+0x334/0x3d8<br /> [ 552.422706] ret_from_fork+0x10/0x20