Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:  drm/imagination: Fix reference and vm_bo handling in remap()  When a map overlaps part of an existing mapping, pvr_vm_gpuva_remap() splits the mapping into prev/next parts covering what the request did not take, instead of creating something new. It gets two things wrong.  - A GEM reference is taken for each part but it's never needed and never   dropped, so it leaks one reference per split (remap-next-in-2m in   tests/imagination/pvr_vm_map.c):      CRITICAL: 33558528 bytes of shmem still held after close  - The parts still belong to the original object being split, but   pvr_vm_gpuva_remap() links them to ctx->gpuvm_bo, the new object's   vm_bo:      prev_va --obj--> BO_A          BO_B <--obj-- vm_bo (ctx->gpuvm_bo)             \___________link___________/  (mismatch: BO_A != BO_B)    drm_gpuva_link() catches the mismatch:      WARNING: drivers/gpu/drm/drm_gpuvm.c:2108 at drm_gpuva_link+0x2ec/0x310       drm_WARN_ON(obj != vm_bo->obj)     Call trace:      drm_gpuva_link      pvr_vm_gpuva_remap      __drm_gpuvm_sm_map      pvr_vm_map      pvr_ioctl_vm_map    Link them to op->remap.unmap->va->vm_bo instead.  The locking of the GPUVA lists of the other objects touched by a split is not addressed here; it is handled by switching the GPUVM to immediate mode.