UBUNTU-CVE-2024-26937
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Reset queue_priority_hint on parking Originally, with strict in order execution, we could complete execution only when the queue was empty. Preempt-to-busy allows replacement of an active request that may complete before the preemption is processed by HW. If that happens, the request is retired from the queue, but the queue_priority_hint remains set, preventing direct submission until after the next CS interrupt is processed. This preempt-to-busy race can be triggered by the heartbeat, which will also act as the power-management barrier and upon completion allow us to idle the HW. We may process the completion of the heartbeat, and begin parking the engine before the CS event that restores the queue_priority_hint, causing us to fail the assertion that it is MIN. <3>[ 166.210729] __engine_park:283 GEM_BUG_ON(engine->sched_engine->queue_priority_hint != (-((int)(~0U >> 1)) - 1)) <0>[ 166.210781] Dumping ftrace buffer: <0>[ 166.210795] --------------------------------- ... <0>[ 167.302811] drm_fdin-1097 2..s1. 165741070us : trace_ports: 0000:00:02.0 rcs0: promote { ccid:20 1217:2 prio 0 } <0>[ 167.302861] drm_fdin-1097 2d.s2. 165741072us : execlists_submission_tasklet: 0000:00:02.0 rcs0: preempting last=1217:2, prio=0, hint=2147483646 <0>[ 167.302928] drm_fdin-1097 2d.s2. 165741072us : __i915_request_unsubmit: 0000:00:02.0 rcs0: fence 1217:2, current 0 <0>[ 167.302992] drm_fdin-1097 2d.s2. 165741073us : __i915_request_submit: 0000:00:02.0 rcs0: fence 3:4660, current 4659 <0>[ 167.303044] drm_fdin-1097 2d.s1. 165741076us : execlists_submission_tasklet: 0000:00:02.0 rcs0: context:3 schedule-in, ccid:40 <0>[ 167.303095] drm_fdin-1097 2d.s1. 165741077us : trace_ports: 0000:00:02.0 rcs0: submit { ccid:40 3:4660* prio 2147483646 } <0>[ 167.303159] kworker/-89 11..... 165741139us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence c90:2, current 2 <0>[ 167.303208] kworker/-89 11..... 165741148us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:c90 unpin <0>[ 167.303272] kworker/-89 11..... 165741159us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 1217:2, current 2 <0>[ 167.303321] kworker/-89 11..... 165741166us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:1217 unpin <0>[ 167.303384] kworker/-89 11..... 165741170us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 3:4660, current 4660 <0>[ 167.303434] kworker/-89 11d..1. 165741172us : __intel_context_retire: 0000:00:02.0 rcs0: context:1216 retire runtime: { total:56028ns, avg:56028ns } <0>[ 167.303484] kworker/-89 11..... 165741198us : __engine_park: 0000:00:02.0 rcs0: parked <0>[ 167.303534] <idle>-0 5d.H3. 165741207us : execlists_irq_handler: 0000:00:02.0 rcs0: semaphore yield: 00000040 <0>[ 167.303583] kworker/-89 11..... 165741397us : __intel_context_retire: 0000:00:02.0 rcs0: context:1217 retire runtime: { total:325575ns, avg:0ns } <0>[ 167.303756] kworker/-89 11..... 165741777us : __intel_context_retire: 0000:00:02.0 rcs0: context:c90 retire runtime: { total:0ns, avg:0ns } <0>[ 167.303806] kworker/-89 11..... 165742017us : __engine_park: __engine_park:283 GEM_BUG_ON(engine->sched_engine->queue_priority_hint != (-((int)(~0U >> 1)) - 1)) <0>[ 167.303811] --------------------------------- <4>[ 167.304722] ------------[ cut here ]------------ <2>[ 167.304725] kernel BUG at drivers/gpu/drm/i915/gt/intel_engine_pm.c:283! <4>[ 167.304731] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI <4>[ 167.304734] CPU: 11 PID: 89 Comm: kworker/11:1 Tainted: G W 6.8.0-rc2-CI_DRM_14193-gc655e0fd2804+ #1 <4>[ 167.304736] Hardware name: Intel Corporation Rocket Lake Client Platform/RocketLake S UDIMM 6L RVP, BIOS RKLSFWI1.R00.3173.A03.2204210138 04/21/2022 <4>[ 167.304738] Workqueue: i915-unordered retire_work_handler [i915] <4>[ 16 ---truncated---
02 / AFFECTED SOFTWARE
Affected packages
37 explicit affected versions
13 explicit affected versions
10 explicit affected versions
27 explicit affected versions
1 explicit affected versions
8 explicit affected versions
1 explicit affected versions
10 explicit affected versions
6 explicit affected versions
8 explicit affected versions
1 explicit affected versions
10 explicit affected versions
3 explicit affected versions
10 explicit affected versions
11 explicit affected versions
31 explicit affected versions
45 explicit affected versions
50 explicit affected versions
26 explicit affected versions
7 explicit affected versions
12 explicit affected versions
19 explicit affected versions
6 explicit affected versions
54 explicit affected versions
4 explicit affected versions
40 explicit affected versions
61 explicit affected versions
51 explicit affected versions
40 explicit affected versions
47 explicit affected versions
7 explicit affected versions
46 explicit affected versions
88 explicit affected versions
13 explicit affected versions
35 explicit affected versions
7 explicit affected versions
14 explicit affected versions
18 explicit affected versions
9 explicit affected versions
34 explicit affected versions
5 explicit affected versions
90 explicit affected versions
13 explicit affected versions
4 explicit affected versions
23 explicit affected versions
7 explicit affected versions
21 explicit affected versions
16 explicit affected versions
45 explicit affected versions
5 explicit affected versions
7 explicit affected versions
12 explicit affected versions
38 explicit affected versions
12 explicit affected versions
14 explicit affected versions
7 explicit affected versions
78 explicit affected versions
12 explicit affected versions
93 explicit affected versions
101 explicit affected versions
12 explicit affected versions
89 explicit affected versions
10 explicit affected versions
31 explicit affected versions
26 explicit affected versions
13 explicit affected versions
6 explicit affected versions
6 explicit affected versions
29 explicit affected versions
81 explicit affected versions
13 explicit affected versions
51 explicit affected versions
77 explicit affected versions
49 explicit affected versions
93 explicit affected versions
11 explicit affected versions
33 explicit affected versions
23 explicit affected versions
10 explicit affected versions
11 explicit affected versions
12 explicit affected versions
7 explicit affected versions
12 explicit affected versions
92 explicit affected versions
39 explicit affected versions
32 explicit affected versions
48 explicit affected versions
10 explicit affected versions
26 explicit affected versions
6 explicit affected versions
27 explicit affected versions
1 explicit affected versions
6 explicit affected versions
13 explicit affected versions
5 explicit affected versions
51 explicit affected versions
16 explicit affected versions
51 explicit affected versions
40 explicit affected versions
3 explicit affected versions
1 explicit affected versions
2 explicit affected versions
58 explicit affected versions
51 explicit affected versions
3 explicit affected versions
12 explicit affected versions
37 explicit affected versions
27 explicit affected versions
23 explicit affected versions
1 explicit affected versions
8 explicit affected versions
12 explicit affected versions
5 explicit affected versions
2 explicit affected versions
13 explicit affected versions
81 explicit affected versions
13 explicit affected versions
13 explicit affected versions
45 explicit affected versions
7 explicit affected versions
43 explicit affected versions
10 explicit affected versions
12 explicit affected versions
12 explicit affected versions
80 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
37 explicit affected versions
37 explicit affected versions
6 explicit affected versions
14 explicit affected versions
38 explicit affected versions
40 explicit affected versions
9 explicit affected versions
40 explicit affected versions
11 explicit affected versions
48 explicit affected versions
21 explicit affected versions
52 explicit affected versions
4 explicit affected versions
1 explicit affected versions
1 explicit affected versions
46 explicit affected versions
13 explicit affected versions
43 explicit affected versions
46 explicit affected versions
10 explicit affected versions
14 explicit affected versions
81 explicit affected versions
4 explicit affected versions
70 explicit affected versions
11 explicit affected versions
1 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Reset queue_priority_hint on parking Originally, with strict in order execution, we could complete execution only when the queue was empty. Preempt-to-busy allows replacement of an active request that may complete before the preemption is processed by HW. If that happens, the request is retired from the queue, but the queue_priority_hint remains set, preventing direct submission until after the next CS interrupt is processed. This preempt-to-busy race can be triggered by the heartbeat, which will also act as the power-management barrier and upon completion allow us to idle the HW. We may process the completion of the heartbeat, and begin parking the engine before the CS event that restores the queue_priority_hint, causing us to fail the assertion that it is MIN. <3>[ 166.210729] __engine_park:283 GEM_BUG_ON(engine->sched_engine->queue_priority_hint != (-((int)(~0U >> 1)) - 1)) <0>[ 166.210781] Dumping ftrace buffer: <0>[ 166.210795] --------------------------------- ... <0>[ 167.302811] drm_fdin-1097 2..s1. 165741070us : trace_ports: 0000:00:02.0 rcs0: promote { ccid:20 1217:2 prio 0 } <0>[ 167.302861] drm_fdin-1097 2d.s2. 165741072us : execlists_submission_tasklet: 0000:00:02.0 rcs0: preempting last=1217:2, prio=0, hint=2147483646 <0>[ 167.302928] drm_fdin-1097 2d.s2. 165741072us : __i915_request_unsubmit: 0000:00:02.0 rcs0: fence 1217:2, current 0 <0>[ 167.302992] drm_fdin-1097 2d.s2. 165741073us : __i915_request_submit: 0000:00:02.0 rcs0: fence 3:4660, current 4659 <0>[ 167.303044] drm_fdin-1097 2d.s1. 165741076us : execlists_submission_tasklet: 0000:00:02.0 rcs0: context:3 schedule-in, ccid:40 <0>[ 167.303095] drm_fdin-1097 2d.s1. 165741077us : trace_ports: 0000:00:02.0 rcs0: submit { ccid:40 3:4660* prio 2147483646 } <0>[ 167.303159] kworker/-89 11..... 165741139us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence c90:2, current 2 <0>[ 167.303208] kworker/-89 11..... 165741148us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:c90 unpin <0>[ 167.303272] kworker/-89 11..... 165741159us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 1217:2, current 2 <0>[ 167.303321] kworker/-89 11..... 165741166us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:1217 unpin <0>[ 167.303384] kworker/-89 11..... 165741170us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 3:4660, current 4660 <0>[ 167.303434] kworker/-89 11d..1. 165741172us : __intel_context_retire: 0000:00:02.0 rcs0: context:1216 retire runtime: { total:56028ns, avg:56028ns } <0>[ 167.303484] kworker/-89 11..... 165741198us : __engine_park: 0000:00:02.0 rcs0: parked <0>[ 167.303534] <idle>-0 5d.H3. 165741207us : execlists_irq_handler: 0000:00:02.0 rcs0: semaphore yield: 00000040 <0>[ 167.303583] kworker/-89 11..... 165741397us : __intel_context_retire: 0000:00:02.0 rcs0: context:1217 retire runtime: { total:325575ns, avg:0ns } <0>[ 167.303756] kworker/-89 11..... 165741777us : __intel_context_retire: 0000:00:02.0 rcs0: context:c90 retire runtime: { total:0ns, avg:0ns } <0>[ 167.303806] kworker/-89 11..... 165742017us : __engine_park: __engine_park:283 GEM_BUG_ON(engine->sched_engine->queue_priority_hint != (-((int)(~0U >> 1)) - 1)) <0>[ 167.303811] --------------------------------- <4>[ 167.304722] ------------[ cut here ]------------ <2>[ 167.304725] kernel BUG at drivers/gpu/drm/i915/gt/intel_engine_pm.c:283! <4>[ 167.304731] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI <4>[ 167.304734] CPU: 11 PID: 89 Comm: kworker/11:1 Tainted: G W 6.8.0-rc2-CI_DRM_14193-gc655e0fd2804+ #1 <4>[ 167.304736] Hardware name: Intel Corporation Rocket Lake Client Platform/RocketLake S UDIMM 6L RVP, BIOS RKLSFWI1.R00.3173.A03.2204210138 04/21/2022 <4>[ 167.304738] Workqueue: i915-unordered retire_work_handler [i915] <4>[ 16 ---truncated---
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/4a3859ea5240365d21f6053ee219bb240d520895
- https://git.kernel.org/stable/c/3b031e4fcb2740988143c303f81f69f18ce86325
- https://git.kernel.org/stable/c/4a3859ea5240365d21f6053ee219bb240d520895
- https://git.kernel.org/stable/c/67944e6db656bf1e986aa2a359f866f851091f8a
- https://git.kernel.org/stable/c/7eab7b021835ae422c38b968d5cc60e99408fb62
- https://git.kernel.org/stable/c/8fd9b0ce8c26533fe4d5d15ea15bbf7b904b611c
- https://git.kernel.org/stable/c/ac9b6b3e8d1237136c8ebf0fa1ce037dd7e2948f
- https://git.kernel.org/stable/c/aed034866a08bb7e6e34d50a5629a4d23fe83703
- https://git.kernel.org/stable/c/fe34587acc995e7b1d7a5d3444a0736721ec32b3
- https://ubuntu.com/security/CVE-2024-26937
- https://ubuntu.com/security/notices/USN-6816-1
- https://ubuntu.com/security/notices/USN-6817-1
- https://ubuntu.com/security/notices/USN-6817-2
- https://ubuntu.com/security/notices/USN-6817-3
- https://ubuntu.com/security/notices/USN-6878-1
- https://ubuntu.com/security/notices/USN-6896-1
- https://ubuntu.com/security/notices/USN-6896-2
- https://ubuntu.com/security/notices/USN-6896-3
- https://ubuntu.com/security/notices/USN-6896-4
- https://ubuntu.com/security/notices/USN-6896-5
- https://ubuntu.com/security/notices/USN-6898-1
- https://ubuntu.com/security/notices/USN-6898-2
- https://ubuntu.com/security/notices/USN-6898-3
- https://ubuntu.com/security/notices/USN-6898-4
- https://ubuntu.com/security/notices/USN-6917-1
- https://ubuntu.com/security/notices/USN-6919-1
- https://ubuntu.com/security/notices/USN-6927-1
- https://ubuntu.com/security/notices/USN-7019-1
- https://www.cve.org/CVERecord?id=CVE-2024-26937