PT-2026-121891
CVE-2026-98919
·
تاريخ النشر
2026-10-23
·
تاريخ التحديث
2026-10-23
الوصف من
الدرجة
N/A
غير متوفرلا تتوفر حاليًا تقييمات أو مقاييس للخطورة. سنحدّث المعلومات المقابلة في الصفحة فور توفرها.
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: harden adjust idledly() against divide-by-zero and overflow
adjust idledly() has several corner-case issues flagged during review:
-
If xe gt clock init() failed to recognise the crystal clock, gt->info.timestamp base is 0, which makes idledly units ps also 0. The subsequent DIV ROUND CLOSEST(..., idledly units ps) is then a divide-by-zero and panics the kernel.
-
The tick-to-ns conversions are done in u32: idledly * idledly units ps, (maxcnt - 1) * 1000 Both overflow u32 before DIV ROUND CLOSEST() sees them.
-
If IDLE WAIT TIME reads back as 0, maxcnt evaluates to 0 and the maxcnt - 1 clamp wraps to 0xFFFFFFFF in u32.
-
The register only stores whole ticks, so the clamped ns value has to be converted to ticks and back. DIV ROUND CLOSEST() can round that conversion up past maxcnt:maxcnt = 640 ns, one tick = 666664 psclamp: maxcnt - 1 = 639 ns ns -> ticks: 639000 / 666664 = 0.958 -> rounds to 1 tick tick -> ns: 1 * 666664 / 1000 = 667 ns
667 ns is programmed into RING IDLEDLY, but 667 >= maxcnt (640),
so xe gt WARN ON() fires again on every subsequent init.
Return early if timestamp base is 0 (the unknown-crystal path).
Do the conversions in u64 via the * ULL() helpers so they cannot wrap.
Clamp with a floor (DIV ROUND DOWN ULL) so the programmed delay stays
strictly below maxcnt, and guard the maxcnt == 0 case with a zero delay
while still writing RING IDLEDLY so INHIBIT SWITCH UNTIL PREEMPTED is
cleared.
v2: Drop the redundant warn on the timestamp base == 0 path;
xe gt clock init() already warns on an unrecognised crystal clock.
Keep the early return to avoid the divide-by-zero. - Vinay
v3: Field-mask the RING IDLEDLY write with REG FIELD PREP(IDLE DELAY, ...)
instead of writing the raw tick count, which could clobber
INHIBIT SWITCH UNTIL PREEMPTED and reserved bits. Split the
inhibit-switch clear from the maxcnt clamp so a set inhibit bit no
longer forces a needless delay overwrite when the delay itself is
already valid. Use gt to xe(gt) instead of gt to xe(hwe->gt).
(cherry picked from commit d864065ea25e9d12897c175de9176ce46677e176)
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾