Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpu_userq_get_doorbell_index() pins any BO passed as doorbell_handle into the doorbell domain. For a regular BO, TTM moves it with ttm_bo_move_null() and its contents are lost. Since an importer on the same device gets the exporter's GEM object, a client can do this to a buffer another client shared with it. Reject BOs that were not created in the doorbell domain. v2: drop the error message, use a local abo variable (Christian) (cherry picked from commit f7497bbc19db4821c62b9d97b31c9086feb2d917)
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
f09c1e6077abd1bc2ddd2b97e1135215801ca7f9 to < 112dbe2b10d6d088a6c599980dd960dcbfa55ff0affectedf09c1e6077abd1bc2ddd2b97e1135215801ca7f9 to < 8640b3f961d743d6dc0458c2b53a3af434690cc1affectedf09c1e6077abd1bc2ddd2b97e1135215801ca7f9 to < 7f7c88dbf4d543f6703e53bdeed380e886733167affected
Linux Linux
Default version status: affected
6.16affected0 to < 6.16unaffected6.18.57 to ≤ 6.18.*unaffected7.2.11 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected