Linux kernel (drivers/gpu/drm/i915/gem): The size of a partial GEM mapping is computed without accounting for the

Impact

The size of a partial GEM mapping is computed without accounting for the mapping offset, so the mapped window can extend past the end of the buffer object. A tenant that faults those pages reaches memory outside its own BO - read and write access to pages the driver never intended to expose to it.

Who can reach it

Tenant container holding /dev/dri/renderD* on an Intel i915 device: create a BO, request an mmap offset with a partial view / non-zero framebuffer offset, mmap it and touch pages past the object's end. Unprivileged, no display or master access required.

What to do

Update to a stable kernel carrying the fix (commits below; no fixed_in published in the record). Interim: drop /dev/dri/renderD* from containers running untrusted code on i915 nodes.

References