Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]drm/i915/ttm: fix CCS handling[EOL][EOL]Crucible + recent Mesa seems to sometimes hit:[EOL][EOL]GEM_BUG_ON(num_ccs_blks > NUM_CCS_BLKS_PER_XFER)[EOL][EOL]And it looks like we can also trigger this with gem_lmem_swapping, if we[EOL]modify the test to use slightly larger object sizes.[EOL][EOL]Looking closer it looks like we have the following issues in[EOL]migrate_copy():[EOL][EOL]  - We are using plain integer in various places, which we can easily[EOL]    overflow with a large object.[EOL][EOL]  - We pass the entire object size (when the src is lmem) into[EOL]    emit_pte() and then try to copy it, which doesn't work, since we[EOL]    only have a few fixed sized windows in which to map the pages and[EOL]    perform the copy. With an object > 8M we therefore aren't properly[EOL]    copying the pages. And then with an object > 64M we trigger the[EOL]    GEM_BUG_ON(num_ccs_blks > NUM_CCS_BLKS_PER_XFER).[EOL][EOL]So it looks like our copy handling for any object > 8M (which is our[EOL]CHUNK_SZ) is currently broken on DG2.[EOL][EOL]Testcase: igt@gem_lmem_swapping[EOL](cherry picked from commit 8676145eb2f53a9940ff70910caf0125bd8a4bc2)

CREATE(Triage):(User=lchen-cn) [CVE-2022-49963 (https://nvd.nist.gov/vuln/detail/CVE-2022-49963)