Description
In the Linux kernel, the following vulnerability has been resolved: drm/buddy: Prevent BUG_ON by validating rounded allocation When DRM_BUDDY_CONTIGUOUS_ALLOCATION is set, the requested size is rounded up to the next power-of-two via roundup_pow_of_two(). Similarly, for non-contiguous allocations with large min_block_size, the size is aligned up via round_up(). Both operations can produce a rounded size that exceeds mm->size, which later triggers BUG_ON(order > mm->max_order). Example scenarios: - 9G CONTIGUOUS allocation on 10G VRAM memory: roundup_pow_of_two(9G) = 16G > 10G - 9G allocation with 8G min_block_size on 10G VRAM memory: round_up(9G, 8G) = 16G > 10G Fix this by checking the rounded size against mm->size. For non-contiguous or range allocations where size > mm->size is invalid, return -EINVAL immediately. For contiguous allocations without range restrictions, allow the request to fall through to the existing __alloc_contig_try_harder() fallback. This ensures invalid user input returns an error or uses the fallback path instead of hitting BUG_ON. v2: (Matt A) - Add Fixes, Cc stable, and Closes tags for context
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
0a1844bf0b532d84324453374ad6845f64066c28 to < d764b8dd420098a4d253b8a5b27568c897edb2cfaffected0a1844bf0b532d84324453374ad6845f64066c28 to < 6236c1cd9fdf433d39ed28b2491ccdfe7ae95061affected0a1844bf0b532d84324453374ad6845f64066c28 to < ecb32c60d8cbed2ee9ce9f343b6aa2f32babc727affected0a1844bf0b532d84324453374ad6845f64066c28 to < 5488a29596cdba93a60a79398dc9b69d5bdadf92affected
Linux Linux
Default version status: affected
6.7affected0 to < 6.7unaffected6.12.75 to ≤ 6.12.*unaffected6.18.16 to ≤ 6.18.*unaffected6.19.6 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected