Linux kernel drm/xe vulnerabilities

In the Linux kernel, a vulnerability was fixed in the drm/xe component's adjust_idledly() function, which failed to handle corner cases. When xe_gt_clock_init() fails to recognize the crystal clock, timestamp_base is 0, leading to a divide-by-zero and kernel panic. Additionally, u32 tick-to-ns conversions can overflow, and incorrect rounding can program a delay value greater than or equal to maxcnt, triggering warnings on every initialization.

A vulnerability was found in the Linux kernel drm/xe component where the exec and vm_bind ioctls do not bound the num_syncs value. Userspace can specify an arbitrarily large num_syncs, forcing an excessively large allocation and triggering kernel page allocator warnings. The fix introduces DRM_XE_MAX_SYNCS (1024) and rejects requests exceeding this limit.

In the Linux kernel's drm/xe subsystem, a stale pinned_link entry is left when framebuffer pinning performs the final unpin. This leaves a list entry pointing into freed memory, risking list corruption and a use-after-free on subsequent list walks or splices.

In the Linux kernel's drm/xe/shrinker component, a bug was found where __xe_shrinker_walk() walks the SYSTEM and TT LRUs without a runtime PM reference. Shrinking a buffer object outside system memory invalidates its GPU mappings, which requires the device to be resumed — while runtime suspended this trips an assertion warning and the TLB invalidation returns -ENODEV.

In the Linux kernel, the drm/xe driver's emit_render_cache_flush() did not request a flush of the LSC untyped L1 dataport cache before releasing memory for reuse. Starting with MTL, the coupling between HDC Pipeline Flush and the untyped L1 cache flush no longer holds reliably, potentially allowing stale data to leak. The fix explicitly sets PIPE_CONTROL0_UNTYPED_DATAPORT_CACHE_FLUSH on Xe2 and later platforms.

A bug in the Linux kernel's drm/xe component caused get_flat_ccs_offset() to round the end of usable VRAM upwards, exposing memory belonging to the hardware compression (flat CCS) region to the VRAM allocator as free memory. The compression hardware then overwrote data in that area without the driver's knowledge, corrupting page tables and hanging the compositor (black screen). The issue primarily affects Intel Battlemage G21 hardware.