Linux kernel source tree
Go to file
Shuicheng Lin 8f565bdd14 drm/xe: Prevent BIT() overflow when handling invalid prefetch region
If user provides a large value (such as 0x80) for parameter
prefetch_mem_region_instance in vm_bind ioctl, it will cause
BIT(prefetch_region) overflow as below:
"
 ------------[ cut here ]------------
 UBSAN: shift-out-of-bounds in drivers/gpu/drm/xe/xe_vm.c:3414:7
 shift exponent 128 is too large for 64-bit type 'long unsigned int'
 CPU: 8 UID: 0 PID: 53120 Comm: xe_exec_system_ Tainted: G        W           6.18.0-rc1-lgci-xe-kernel+ #200 PREEMPT(voluntary)
 Tainted: [W]=WARN
 Hardware name: ASUS System Product Name/PRIME Z790-P WIFI, BIOS 0812 02/24/2023
 Call Trace:
  <TASK>
  dump_stack_lvl+0xa0/0xc0
  dump_stack+0x10/0x20
  ubsan_epilogue+0x9/0x40
  __ubsan_handle_shift_out_of_bounds+0x10e/0x170
  ? mutex_unlock+0x12/0x20
  xe_vm_bind_ioctl.cold+0x20/0x3c [xe]
 ...
"
Fix it by validating prefetch_region before the BIT() usage.

v2: Add Closes and Cc stable kernels. (Matt)

Reported-by: Koen Koning <koen.koning@intel.com>
Reported-by: Peter Senna Tschudin <peter.senna@linux.intel.com>
Fixes: dd08ebf6c3 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6478
Cc: <stable@vger.kernel.org> # v6.8+
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Link: https://patch.msgid.link/20251112181005.2120521-2-shuicheng.lin@intel.com
2025-11-14 13:53:27 +00:00
arch Kbuild fixes for 6.18 #1 2025-10-11 15:47:12 -07:00
block block-6.18-20251009 2025-10-10 10:37:13 -07:00
certs sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 2024-09-20 19:52:48 +03:00
crypto This push contains the following changes: 2025-10-10 08:56:16 -07:00
Documentation drm/xe/pf: Add documentation for sriov_admin attributes 2025-10-31 20:01:52 +01:00
drivers drm/xe: Prevent BIT() overflow when handling invalid prefetch region 2025-11-14 13:53:27 +00:00
fs - Avoid -Wflex-array-member-not-at-end warnings 2025-10-10 14:06:02 -07:00
include drm/intel/bmg: Allow device ID usage with single-argument macros 2025-11-13 11:48:20 +01:00
init printk changes for 6.18 2025-10-04 11:13:11 -07:00
io_uring io_uring/zcrx: increment fallback loop src offset 2025-10-08 07:26:14 -06:00
ipc namespace-6.18-rc1 2025-09-29 11:20:29 -07:00
kernel tracing fixes for v6.18: 2025-10-11 16:06:04 -07:00
lib lib/test_kho: use kho_preserve_vmalloc instead of storing addresses in fdt 2025-10-07 13:48:56 -07:00
LICENSES LICENSES: Replace the obsolete address of the FSF in the GFDL-1.2 2025-07-24 11:15:39 +02:00
mm slab hotfix for 6.18-rc1 2025-10-11 10:40:24 -07:00
net bpf-fixes 2025-10-11 10:31:38 -07:00
rust 7 hotfixes. All 7 are cc:stable and all 7 are for MM. 2025-10-11 10:14:55 -07:00
samples Char/Misc/IIO/Binder changes for 6.18-rc1 2025-10-04 16:26:32 -07:00
scripts Kbuild fixes for 6.18 #1 2025-10-11 15:47:12 -07:00
security integrity-v6.18 2025-10-05 10:48:33 -07:00
sound sound fixes for 6.18-rc1 2025-10-10 09:55:19 -07:00
tools - Remove a bunch of asm implementing condition flags testing in KVM's 2025-10-11 11:19:16 -07:00
usr gen_init_cpio: Ignore fsync() returning EINVAL on pipes 2025-10-07 09:53:05 -07:00
virt hyperv-next for v6.18 2025-10-07 08:40:15 -07:00
.clang-format memblock: drop for_each_free_mem_pfn_range_in_zone_from() 2025-09-14 08:49:03 +03:00
.clippy.toml rust: clean Rust 1.88.0's warning about clippy::disallowed_macros configuration 2025-05-07 00:11:47 +02:00
.cocciconfig
.editorconfig .editorconfig: remove trim_trailing_whitespace option 2024-06-13 16:47:52 +02:00
.get_maintainer.ignore MAINTAINERS: remove Alyssa Rosenzweig 2025-09-18 21:17:31 +02:00
.gitattributes .gitattributes: set diff driver for Rust source code files 2023-05-31 17:48:25 +02:00
.gitignore .gitignore: ignore compile_commands.json globally 2025-08-12 15:53:55 -07:00
.mailmap MAINTAINERS, .mailmap: update Umang's email address 2025-10-07 13:48:55 -07:00
.pylintrc tools: docs: parse-headers.py: move it from sphinx dir 2025-08-29 15:54:42 -06:00
.rustfmt.toml
COPYING
CREDITS USB/Thunderbolt changes for 6.18-rc1 2025-10-04 16:07:08 -07:00
Kbuild sched: Make migrate_{en,dis}able() inline 2025-09-25 09:57:16 +02:00
Kconfig io_uring: Rename KConfig to Kconfig 2025-02-19 14:53:27 -07:00
MAINTAINERS Just one series here - Mike Rappoport has taught KEXEC handover to 2025-10-11 10:27:52 -07:00
Makefile Linux 6.18-rc1 2025-10-12 13:42:36 -07:00
README README: Fix spelling 2024-03-18 03:36:32 -06:00

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.