Jia Yao fbbe32618e drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise ... When user provides a bogus pat_index value through the madvise IOCTL, the xe_pat_index_get_coh_mode() function performs an array access without validating bounds. This allows a malicious user to trigger an out-of-bounds kernel read from the xe->pat.table array. The vulnerability exists because the validation in madvise_args_are_sane() directly calls xe_pat_index_get_coh_mode(xe, args->pat_index.val) without first checking if pat_index is within [0, xe->pat.n_entries). Although xe_pat_index_get_coh_mode() has a WARN_ON to catch this in debug builds, it still performs the unsafe array access in production kernels. v2(Matthew Auld) - Using array_index_nospec() to mitigate spectre attacks when the value is used v3(Matthew Auld) - Put the declarations at the start of the block Fixes: ada7486c56 ("drm/xe: Implement madvise ioctl for xe") Reviewed-by: Matthew Auld <matthew.auld@intel.com> Cc: <stable@vger.kernel.org> # v6.18+ Cc: Matthew Brost <matthew.brost@intel.com> Cc: Shuicheng Lin <shuicheng.lin@intel.com> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Cc: "Thomas Hellström" <thomas.hellstrom@linux.intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Matthew Auld <matthew.auld@intel.com> Signed-off-by: Jia Yao <jia.yao@intel.com> Signed-off-by: Matthew Auld <matthew.auld@intel.com> Link: https://patch.msgid.link/20260205161529.1819276-1-jia.yao@intel.com (cherry picked from commit 944a3329b0) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>		2026-02-17 19:39:04 -05:00
..
drm	drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise	2026-02-17 19:39:04 -05:00
host1x	host1x: Convert to bus methods	2026-01-13 12:26:32 +01:00
ipu-v3
nova-core	gpu: nova-core: align LibosMemoryRegionInitArgument size to page size	2026-01-24 10:48:59 +09:00
trace
vga	vga_switcheroo: Use pci_is_display()	2025-07-17 15:30:13 -05:00
Makefile