i915 GEM Phys BO Pread/Pwrite Offset Handling Fix

Executive Summary

This vulnerability exists in the Linux kernel's drm/i915/gem component. It involves incorrect handling of physical buffer objects (phys BO) during pread and pwrite operations with an offset. Specifically, the function sg_page() returns a struct page pointer rather than a void pointer, which causes incorrect scaling of pread/pwrite operations for phys BO. As a result, when a non-zero offset is used, wrong parts of the buffer object (BO) could be accessed.

The issue affected platforms with overlay or cursor planes using physical mapping, particularly older hardware such as Gen3/945G/Lakeport.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause incorrect memory regions to be accessed during read or write operations on physical buffer objects in the graphics subsystem. This could potentially lead to data corruption or unintended data exposure if wrong parts of memory are accessed.

Since the issue affects graphics memory handling on certain older platforms, it might impact system stability or graphics rendering correctness on those systems.

Useful 0 Not Useful 0