Linux kernel (drivers/gpu/drm/i915/gt): The GPU migration copy path used plain ints for sizes that a tenant controls

Impact

The GPU migration copy path used plain ints for sizes that a tenant controls and fed the whole object size into a fixed-size mapping window, so any buffer object larger than the 8MB chunk size is copied incorrectly and objects past 64MB blow through the compression-block limit. Migration is how buffers move between VRAM and system memory, so the consequence is corrupted or partially-copied tenant data and out-of-range block counts on discrete Intel GPUs.

Who can reach it

A tenant container holding /dev/dri/renderD* on a discrete Intel GPU (DG2 class) only has to allocate large buffer objects and let them be evicted or swapped - the upstream reproducers are the stock GPU memory-swapping IGT tests with slightly larger object sizes. No privilege beyond the render node.

What to do

Boot a kernel carrying the i915 migration/CCS fix below. Interim: cap per-tenant buffer-object and VRAM sizes to keep large-object migration out of play, and avoid overcommitting VRAM so eviction is rare.

References