Linux kernel (drivers/gpu/drm/xe): The migration copy path falls back to a stack bounce buffer when the tenant's buffer

Impact

The migration copy path falls back to a stack bounce buffer when the tenant's buffer is not cacheline-aligned, but that bounce buffer has no alignment guarantee either, so the function recurses into itself until the kernel stack is exhausted. The result is a kernel panic triggered on demand by one tenant, taking the node - and every other tenant's job on it - down.

Who can reach it

A tenant container holding /dev/dri/renderD* on an Intel xe GPU passes a misaligned buffer/offset into the VRAM access path; upstream hit it through the GPU debug interface, and any caller that reaches xe_migrate's non-aligned copy fallback does the same. Unprivileged, render-node only.

What to do

Boot a kernel carrying the xe_migrate bounce-buffer fix below. Interim: deny the GPU debug/eudebug interface to tenant containers, and drop /dev/dri/renderD* from workloads that do not need direct VRAM access.

References