CVE-2022-49963

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/ttm: fix CCS handling

Crucible + recent Mesa seems to sometimes hit:

GEM_BUG_ON(num_ccs_blks > NUM_CCS_BLKS_PER_XFER)

And it looks like we can also trigger this with gem_lmem_swapping, if we

modify the test to use slightly larger object sizes.

Looking closer it looks like we have the following issues in

migrate_copy():

- We are using plain integer in various places, which we can easily

overflow with a large object.

- We pass the entire object size (when the src is lmem) into

emit_pte() and then try to copy it, which doesn't work, since we

only have a few fixed sized windows in which to map the pages and

perform the copy. With an object > 8M we therefore aren't properly

copying the pages. And then with an object > 64M we trigger the

GEM_BUG_ON(num_ccs_blks > NUM_CCS_BLKS_PER_XFER).

So it looks like our copy handling for any object > 8M (which is our

CHUNK_SZ) is currently bro

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References