| From bippy-1.2.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2023-52912: drm/amdgpu: Fixed bug on error when unloading amdgpu |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| drm/amdgpu: Fixed bug on error when unloading amdgpu |
| |
| Fixed bug on error when unloading amdgpu. |
| |
| The error message is as follows: |
| [ 377.706202] kernel BUG at drivers/gpu/drm/drm_buddy.c:278! |
| [ 377.706215] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI |
| [ 377.706222] CPU: 4 PID: 8610 Comm: modprobe Tainted: G IOE 6.0.0-thomas #1 |
| [ 377.706231] Hardware name: ASUS System Product Name/PRIME Z390-A, BIOS 2004 11/02/2021 |
| [ 377.706238] RIP: 0010:drm_buddy_free_block+0x26/0x30 [drm_buddy] |
| [ 377.706264] Code: 00 00 00 90 0f 1f 44 00 00 48 8b 0e 89 c8 25 00 0c 00 00 3d 00 04 00 00 75 10 48 8b 47 18 48 d3 e0 48 01 47 28 e9 fa fe ff ff <0f> 0b 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 54 55 48 89 f5 53 |
| [ 377.706282] RSP: 0018:ffffad2dc4683cb8 EFLAGS: 00010287 |
| [ 377.706289] RAX: 0000000000000000 RBX: ffff8b1743bd5138 RCX: 0000000000000000 |
| [ 377.706297] RDX: ffff8b1743bd5160 RSI: ffff8b1743bd5c78 RDI: ffff8b16d1b25f70 |
| [ 377.706304] RBP: ffff8b1743bd59e0 R08: 0000000000000001 R09: 0000000000000001 |
| [ 377.706311] R10: ffff8b16c8572400 R11: ffffad2dc4683cf0 R12: ffff8b16d1b25f70 |
| [ 377.706318] R13: ffff8b16d1b25fd0 R14: ffff8b1743bd59c0 R15: ffff8b16d1b25f70 |
| [ 377.706325] FS: 00007fec56c72c40(0000) GS:ffff8b1836500000(0000) knlGS:0000000000000000 |
| [ 377.706334] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 |
| [ 377.706340] CR2: 00007f9b88c1ba50 CR3: 0000000110450004 CR4: 00000000003706e0 |
| [ 377.706347] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 |
| [ 377.706354] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 |
| [ 377.706361] Call Trace: |
| [ 377.706365] <TASK> |
| [ 377.706369] drm_buddy_free_list+0x2a/0x60 [drm_buddy] |
| [ 377.706376] amdgpu_vram_mgr_fini+0xea/0x180 [amdgpu] |
| [ 377.706572] amdgpu_ttm_fini+0x12e/0x1a0 [amdgpu] |
| [ 377.706650] amdgpu_bo_fini+0x22/0x90 [amdgpu] |
| [ 377.706727] gmc_v11_0_sw_fini+0x26/0x30 [amdgpu] |
| [ 377.706821] amdgpu_device_fini_sw+0xa1/0x3c0 [amdgpu] |
| [ 377.706897] amdgpu_driver_release_kms+0x12/0x30 [amdgpu] |
| [ 377.706975] drm_dev_release+0x20/0x40 [drm] |
| [ 377.707006] release_nodes+0x35/0xb0 |
| [ 377.707014] devres_release_all+0x8b/0xc0 |
| [ 377.707020] device_unbind_cleanup+0xe/0x70 |
| [ 377.707027] device_release_driver_internal+0xee/0x160 |
| [ 377.707033] driver_detach+0x44/0x90 |
| [ 377.707039] bus_remove_driver+0x55/0xe0 |
| [ 377.707045] pci_unregister_driver+0x3b/0x90 |
| [ 377.707052] amdgpu_exit+0x11/0x6c [amdgpu] |
| [ 377.707194] __x64_sys_delete_module+0x142/0x2b0 |
| [ 377.707201] ? fpregs_assert_state_consistent+0x22/0x50 |
| [ 377.707208] ? exit_to_user_mode_prepare+0x3e/0x190 |
| [ 377.707215] do_syscall_64+0x38/0x90 |
| [ 377.707221] entry_SYSCALL_64_after_hwframe+0x63/0xcd |
| |
| The Linux kernel CVE team has assigned CVE-2023-52912 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.19 with commit c9cad937c0c58618fe5b0310fd539a854dc1ae95 and fixed in 6.1.7 with commit 9196eb7c52e55749a332974f0081f77d53d60199 |
| Issue introduced in 5.19 with commit c9cad937c0c58618fe5b0310fd539a854dc1ae95 and fixed in 6.2 with commit 99f1a36c90a7524972be5a028424c57fa17753ee |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2023-52912 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/9196eb7c52e55749a332974f0081f77d53d60199 |
| https://git.kernel.org/stable/c/99f1a36c90a7524972be5a028424c57fa17753ee |
