CVE-2022-49723

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/reset: Fix error_state_read ptr + offset use

Fix our pointer offset usage in error_state_read

when there is no i915_gpu_coredump but buf offset

is non-zero.

This fixes a kernel page fault can happen when

multiple tests are running concurrently in a loop

and one is producing engine resets and consuming

the i915 error_state dump while the other is

forcing full GT resets. (takes a while to trigger).

The dmesg call trace:

[ 5590.803000] BUG: unable to handle page fault for address:

ffffffffa0b0e000

[ 5590.803009] #PF: supervisor read access in kernel mode

[ 5590.803013] #PF: error_code(0x0000) - not-present page

[ 5590.803016] PGD 5814067 P4D 5814067 PUD 5815063 PMD 109de4067

PTE 0

[ 5590.803022] Oops: 0000 [#1] PREEMPT SMP NOPTI

[ 5590.803026] CPU: 5 PID: 13656 Comm: i915_hangman Tainted: G U

5.17.0-rc5-ups69-guc-err-capt-rev6+ #136

[ 5590.803033] Hardware na

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References