CVE-2023-52632: drm/amdkfd: Fix lock dependency warning with srcu

Published Apr 2, 2024
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix lock dependency warning with srcu

====================================================== WARNING: possible circular locking dependency detected 6.5.0-kfd-yangp #2289 Not tainted ------------------------------------------------------ kworker/0:2/996 is trying to acquire lock: (srcu){.+.+}-{0:0}, at: synchronizesrcu+0x5/0x1a0

but task is already holding lock: ((workcompletion)(&svms->deferredlistwork)){+.+.}-{0:0}, at: processonework+0x211/0x560

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #3 ((workcompletion)(&svms->deferredlistwork)){+.+.}-{0:0}: flushwork+0x88/0x4f0 svmrangelistlockandflushwork+0x3d/0x110 [amdgpu] svmrangesetattr+0xd6/0x14c0 [amdgpu] kfdioctl+0x1d1/0x630 [amdgpu] x64sysioctl+0x88/0xc0

-> #2 (&info->lock#2){+.+.}-{3:3}: mutexlock+0x99/0xc70 amdgpuamdkfdgpuvmrestoreprocessbos+0x54/0x740 [amdgpu] restoreprocesshelper+0x22/0x80 [amdgpu] restoreprocessworker+0x2d/0xa0 [amdgpu] processonework+0x29b/0x560 workerthread+0x3d/0x3d0

-> #1 ((workcompletion)(&(&process->restorework)->work)){+.+.}-{0:0}: flushwork+0x88/0x4f0 cancelworktimer+0x12c/0x1c0 kfdprocessnotifierreleaseinternal+0x37/0x1f0 [amdgpu] mmunotifierrelease+0xad/0x240 exitmmap+0x6a/0x3a0 mmput+0x6a/0x120 doexit+0x322/0xb90 dogroupexit+0x37/0xa0 x64sysexitgroup+0x18/0x20 dosyscall64+0x38/0x80

-> #0 (srcu){.+.+}-{0:0}: lockacquire+0x1521/0x2510 locksync+0x5f/0x90 synchronizesrcu+0x4f/0x1a0 mmunotifierrelease+0x128/0x240 exitmmap+0x6a/0x3a0 mmput+0x6a/0x120 svmrangedeferredlistwork+0x19f/0x350 [amdgpu] processonework+0x29b/0x560 workerthread+0x3d/0x3d0

other info that might help us debug this: Chain exists of: srcu --> &info->lock#2 --> (workcompletion)(&svms->deferredlistwork)

Possible unsafe locking scenario:

CPU0 CPU1 ---- ---- lock((workcompletion)(&svms->deferredlistwork)); lock(&info->lock#2); lock((workcompletion)(&svms->deferredlistwork)); sync(srcu);

Other sources

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix lock dependency warning with srcu

The Linux kernel CVE team has assigned CVE-2023-52632 to this issue.

Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040218-CVE-2023-52632-f7bb@gregkh/T

— Red Hat

Affected Software

8 affected componentsFixes available
redhat/kernel<6.1.77
6.1.77
redhat/kernel<6.6.16
6.6.16
redhat/kernel<6.7.4
6.7.4
redhat/kernel<6.8
6.8
Linux Linux kernel<6.1.77
Linux Linux kernel>=6.2<6.6.16
Linux Linux kernel>=6.7<6.7.4
debian/linux
5.10.223-15.10.234-16.1.129-16.1.135-16.12.25-16.12.27-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
  2. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 6.1.77
  3. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 6.6.16
  4. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 6.7.4
  5. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 6.8

Event History

Apr 2, 2024
CVE Published
via MITRE·06:49 AM
Data Sourced
via MITRE·06:49 AM
Description
Data Sourced
via NVD·07:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via Red Hat·11:29 PM
DescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2023-52632?

CVE-2023-52632 has been classified as a moderate severity vulnerability.

2

How do I fix CVE-2023-52632?

To fix CVE-2023-52632, update your Linux kernel to the recommended versions, such as 6.1.77 or later.

3

What affected software is associated with CVE-2023-52632?

CVE-2023-52632 affects multiple versions of the Linux kernel across different distributions including Red Hat and Debian.

4

Is CVE-2023-52632 exploitable remotely?

CVE-2023-52632 is not known to be exploitable remotely; it primarily concerns local privileges.

5

What systems are at risk from CVE-2023-52632?

Systems running specific vulnerable versions of the Linux kernel, including certain releases of Red Hat and Debian, are at risk from CVE-2023-52632.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203