CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: use uninterruptible resv lock for plane updates

virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock
the framebuffer BO's dma_resv via virtio_gpu_array_lock_resv() and
ignore its return value. The function can fail with -EINTR from
dma_resv_lock_interruptible() (signal during lock wait) or with
-ENOMEM from dma_resv_reserve_fences() (fence slot allocation),
leaving the resv lock not held. The queue path then walks the object
array and calls dma_resv_add_fence(), which requires the lock held;
with lockdep enabled this trips dma_resv_assert_held():

  WARNING: drivers/dma-buf/dma-resv.c:296 at dma_resv_add_fence+0x71e/0x840
  Call Trace:
   virtio_gpu_array_add_fence
   virtio_gpu_queue_ctrl_sgs
   virtio_gpu_queue_fenced_ctrl_buffer
   virtio_gpu_cursor_plane_update
   drm_atomic_helper_commit_planes
   drm_atomic_helper_commit_tail
   commit_tail
   drm_atomic_helper_commit
   drm_atomic_commit
   drm_atomic_helper_update_plane
   __setplane_atomic
   drm_mode_cursor_universal
   drm_mode_cursor_common
   drm_mode_cursor_ioctl
   drm_ioctl
   __x64_sys_ioctl

Beyond the WARN, mutating the dma_resv fence list without the lock
races with concurrent readers/writers and can corrupt the list.

Both call sites run inside the .atomic_update plane callback, which
DRM atomic helpers do not allow to fail (by the time it runs, the
commit has been signed off to userspace and there is no clean
rollback path). Moving the lock acquisition to .prepare_fb was
rejected because the broader lock scope deadlocks against other BO
locking paths in the same atomic commit.

Introduce virtio_gpu_lock_one_resv_uninterruptible() that uses
dma_resv_lock() instead of dma_resv_lock_interruptible(). This
eliminates the -EINTR failure mode -- the realistic syzbot trigger
-- without extending the lock hold across the commit. The helper
locks a single BO and rejects nents > 1 with -EINVAL; both fix
sites lock exactly one BO.

Use it from virtio_gpu_cursor_plane_update() and
virtio_gpu_resource_flush(); check the return value to handle the
remaining -ENOMEM case from dma_resv_reserve_fences() by freeing
the objs and skipping the plane update for that frame. The
framebuffer BOs touched here are not shared with other contexts
and lock contention is expected to be brief, so the loss of
signal-interruptibility is acceptable.

Other callers of virtio_gpu_array_lock_resv() (the ioctl paths)
continue to use the interruptible variant.

The bug was reported by syzbot, triggered via fault injection
(fail_nth) on the DRM_IOCTL_MODE_CURSOR path, which forces the
-ENOMEM branch in dma_resv_reserve_fences().

The Linux kernel CVE team has assigned CVE-2026-64098 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.7 with commit 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 and fixed in 6.1.175 with commit c86077d512ee980cc91322211d35dbcd3175f64c
	Issue introduced in 5.7 with commit 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 and fixed in 6.6.142 with commit 21ab64c77a30d56efc506c8fa2ad8959f8ce3d36
	Issue introduced in 5.7 with commit 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 and fixed in 6.12.92 with commit 7930eee22cd3df61e85be8aa512032ab303b7167
	Issue introduced in 5.7 with commit 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 and fixed in 6.18.34 with commit 8fadd01cf461fee5bb11506621339c548447e5c7
	Issue introduced in 5.7 with commit 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 and fixed in 7.0.11 with commit a2359a411b15f495d12cfda6a7db6855ebb7f90f
	Issue introduced in 5.7 with commit 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 and fixed in 7.1 with commit 9af1b6e175c82daf4b423da339a722d8e67a735a

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64098
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/virtio/virtgpu_drv.h
	drivers/gpu/drm/virtio/virtgpu_gem.c
	drivers/gpu/drm/virtio/virtgpu_plane.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c86077d512ee980cc91322211d35dbcd3175f64c
	https://git.kernel.org/stable/c/21ab64c77a30d56efc506c8fa2ad8959f8ce3d36
	https://git.kernel.org/stable/c/7930eee22cd3df61e85be8aa512032ab303b7167
	https://git.kernel.org/stable/c/8fadd01cf461fee5bb11506621339c548447e5c7
	https://git.kernel.org/stable/c/a2359a411b15f495d12cfda6a7db6855ebb7f90f
	https://git.kernel.org/stable/c/9af1b6e175c82daf4b423da339a722d8e67a735a