Linux kernel (drivers/gpu/drm/xe): Xe built its scatter-gather table from HMM page pointers without holding the

Impact

Xe built its scatter-gather table from HMM page pointers without holding the notifier lock or validating the notifier sequence, so it dereferenced and dirtied struct pages the driver holds no reference to. A tenant that races a munmap or page migration against a userptr GPU mapping makes the driver touch pages that have already moved on to someone else - stale-page reference and corruption of memory the GPU was never entitled to.

Who can reach it

Unprivileged process in a container with /dev/dri/renderD* on an Intel Xe node: register a userptr GPU mapping, then unmap or migrate the backing memory concurrently with the driver's page-fault population path. No display node, no root, and userptr is exposed to any render-node client.

What to do

Boot a kernel with the fix commits below, which builds the sg-table under a validated notifier seqno. Interim: restrict /dev/dri/renderD* to trusted workloads on xe hosts.

References