CVE-2025-21939 (GCVE-0-2025-21939)
Vulnerability from cvelistv5
Published
2025-04-01 15:41
Modified
2025-05-04 07:25
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe/hmm: Don't dereference struct page pointers without notifier lock The pnfs that we obtain from hmm_range_fault() point to pages that we don't have a reference on, and the guarantee that they are still in the cpu page-tables is that the notifier lock must be held and the notifier seqno is still valid. So while building the sg table and marking the pages accesses / dirty we need to hold this lock with a validated seqno. However, the lock is reclaim tainted which makes sg_alloc_table_from_pages_segment() unusable, since it internally allocates memory. Instead build the sg-table manually. For the non-iommu case this might lead to fewer coalesces, but if that's a problem it can be fixed up later in the resource cursor code. For the iommu case, the whole sg-table may still be coalesced to a single contigous device va region. This avoids marking pages that we don't own dirty and accessed, and it also avoid dereferencing struct pages that we don't own. v2: - Use assert to check whether hmm pfns are valid (Matthew Auld) - Take into account that large pages may cross range boundaries (Matthew Auld) v3: - Don't unnecessarily check for a non-freed sg-table. (Matthew Auld) - Add a missing up_read() in an error path. (Matthew Auld) (cherry picked from commit ea3e66d280ce2576664a862693d1da8fd324c317)
References
Impacted products
Vendor Product Version
Linux Linux Version: 81e058a3e7fd8593d076b4f26f7b8bb49f1d61e3
Version: 81e058a3e7fd8593d076b4f26f7b8bb49f1d61e3
Version: 81e058a3e7fd8593d076b4f26f7b8bb49f1d61e3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_hmm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2a24c98f0e4cc994334598d4f3a851972064809d",
              "status": "affected",
              "version": "81e058a3e7fd8593d076b4f26f7b8bb49f1d61e3",
              "versionType": "git"
            },
            {
              "lessThan": "f9326f529da7298a95643c3267f1c0fdb0db55eb",
              "status": "affected",
              "version": "81e058a3e7fd8593d076b4f26f7b8bb49f1d61e3",
              "versionType": "git"
            },
            {
              "lessThan": "0a98219bcc961edd3388960576e4353e123b4a51",
              "status": "affected",
              "version": "81e058a3e7fd8593d076b4f26f7b8bb49f1d61e3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_hmm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.19",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.7",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/hmm: Don\u0027t dereference struct page pointers without notifier lock\n\nThe pnfs that we obtain from hmm_range_fault() point to pages that\nwe don\u0027t have a reference on, and the guarantee that they are still\nin the cpu page-tables is that the notifier lock must be held and the\nnotifier seqno is still valid.\n\nSo while building the sg table and marking the pages accesses / dirty\nwe need to hold this lock with a validated seqno.\n\nHowever, the lock is reclaim tainted which makes\nsg_alloc_table_from_pages_segment() unusable, since it internally\nallocates memory.\n\nInstead build the sg-table manually. For the non-iommu case\nthis might lead to fewer coalesces, but if that\u0027s a problem it can\nbe fixed up later in the resource cursor code. For the iommu case,\nthe whole sg-table may still be coalesced to a single contigous\ndevice va region.\n\nThis avoids marking pages that we don\u0027t own dirty and accessed, and\nit also avoid dereferencing struct pages that we don\u0027t own.\n\nv2:\n- Use assert to check whether hmm pfns are valid (Matthew Auld)\n- Take into account that large pages may cross range boundaries\n  (Matthew Auld)\n\nv3:\n- Don\u0027t unnecessarily check for a non-freed sg-table. (Matthew Auld)\n- Add a missing up_read() in an error path. (Matthew Auld)\n\n(cherry picked from commit ea3e66d280ce2576664a862693d1da8fd324c317)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:25:05.653Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2a24c98f0e4cc994334598d4f3a851972064809d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9326f529da7298a95643c3267f1c0fdb0db55eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a98219bcc961edd3388960576e4353e123b4a51"
        }
      ],
      "title": "drm/xe/hmm: Don\u0027t dereference struct page pointers without notifier lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21939",
    "datePublished": "2025-04-01T15:41:05.393Z",
    "dateReserved": "2024-12-29T08:45:45.789Z",
    "dateUpdated": "2025-05-04T07:25:05.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21939\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-01T16:15:24.773\",\"lastModified\":\"2025-04-01T20:26:01.990\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/xe/hmm: Don\u0027t dereference struct page pointers without notifier lock\\n\\nThe pnfs that we obtain from hmm_range_fault() point to pages that\\nwe don\u0027t have a reference on, and the guarantee that they are still\\nin the cpu page-tables is that the notifier lock must be held and the\\nnotifier seqno is still valid.\\n\\nSo while building the sg table and marking the pages accesses / dirty\\nwe need to hold this lock with a validated seqno.\\n\\nHowever, the lock is reclaim tainted which makes\\nsg_alloc_table_from_pages_segment() unusable, since it internally\\nallocates memory.\\n\\nInstead build the sg-table manually. For the non-iommu case\\nthis might lead to fewer coalesces, but if that\u0027s a problem it can\\nbe fixed up later in the resource cursor code. For the iommu case,\\nthe whole sg-table may still be coalesced to a single contigous\\ndevice va region.\\n\\nThis avoids marking pages that we don\u0027t own dirty and accessed, and\\nit also avoid dereferencing struct pages that we don\u0027t own.\\n\\nv2:\\n- Use assert to check whether hmm pfns are valid (Matthew Auld)\\n- Take into account that large pages may cross range boundaries\\n  (Matthew Auld)\\n\\nv3:\\n- Don\u0027t unnecessarily check for a non-freed sg-table. (Matthew Auld)\\n- Add a missing up_read() in an error path. (Matthew Auld)\\n\\n(cherry picked from commit ea3e66d280ce2576664a862693d1da8fd324c317)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/xe/hmm: No desreferenciar punteros de p\u00e1gina de estructura sin bloqueo de notificador Los pnfs que obtenemos de hmm_range_fault() apuntan a p\u00e1ginas en las que no tenemos una referencia, y la garant\u00eda de que a\u00fan est\u00e1n en las tablas de p\u00e1ginas de la CPU es que el bloqueo del notificador debe mantenerse y el seqno del notificador a\u00fan es v\u00e1lido. Entonces, mientras construimos la tabla sg y marcamos las p\u00e1ginas como accedidas/sucias, necesitamos mantener este bloqueo con un seqno validado. Sin embargo, el bloqueo est\u00e1 contaminado por recuperaci\u00f3n, lo que hace que sg_alloc_table_from_pages_segment() sea inutilizable, ya que asigna memoria internamente. En su lugar, construya la tabla sg manualmente. Para el caso que no es iommu, esto podr\u00eda llevar a menos coalescencias, pero si eso es un problema, se puede arreglar m\u00e1s adelante en el c\u00f3digo del cursor de recursos. En el caso de iommu, toda la tabla sg puede fusionarse en una \u00fanica regi\u00f3n va de dispositivo contiguo. Esto evita marcar p\u00e1ginas que no son de nuestra propiedad como sucias y accedidas, y tambi\u00e9n evita desreferenciar p\u00e1ginas de estructura que no son de nuestra propiedad. v2: - Usar assert para comprobar si las funciones de funci\u00f3n de enlace de hmm son v\u00e1lidas (Matthew Auld). - Tener en cuenta que las p\u00e1ginas grandes pueden cruzar los l\u00edmites de rango (Matthew Auld). v3: - No comprobar innecesariamente si hay una tabla sg no liberada (Matthew Auld). - A\u00f1adir una funci\u00f3n up_read() faltante en una ruta de error (Matthew Auld). (Seleccionado de el commit ea3e66d280ce2576664a862693d1da8fd324c317).\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0a98219bcc961edd3388960576e4353e123b4a51\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2a24c98f0e4cc994334598d4f3a851972064809d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f9326f529da7298a95643c3267f1c0fdb0db55eb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.