CVE-2023-52632: drm/amdkfd: Fix lock dependency warning with srcu
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix lock dependency warning with srcu
====================================================== WARNING: possible circular locking dependency detected 6.5.0-kfd-yangp #2289 Not tainted ------------------------------------------------------ kworker/0:2/996 is trying to acquire lock: (srcu){.+.+}-{0:0}, at: synchronizesrcu+0x5/0x1a0
but task is already holding lock: ((workcompletion)(&svms->deferredlistwork)){+.+.}-{0:0}, at: processonework+0x211/0x560
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 ((workcompletion)(&svms->deferredlistwork)){+.+.}-{0:0}: flushwork+0x88/0x4f0 svmrangelistlockandflushwork+0x3d/0x110 [amdgpu] svmrangesetattr+0xd6/0x14c0 [amdgpu] kfdioctl+0x1d1/0x630 [amdgpu] x64sysioctl+0x88/0xc0
-> #2 (&info->lock#2){+.+.}-{3:3}: mutexlock+0x99/0xc70 amdgpuamdkfdgpuvmrestoreprocessbos+0x54/0x740 [amdgpu] restoreprocesshelper+0x22/0x80 [amdgpu] restoreprocessworker+0x2d/0xa0 [amdgpu] processonework+0x29b/0x560 workerthread+0x3d/0x3d0
-> #1 ((workcompletion)(&(&process->restorework)->work)){+.+.}-{0:0}: flushwork+0x88/0x4f0 cancelworktimer+0x12c/0x1c0 kfdprocessnotifierreleaseinternal+0x37/0x1f0 [amdgpu] mmunotifierrelease+0xad/0x240 exitmmap+0x6a/0x3a0 mmput+0x6a/0x120 doexit+0x322/0xb90 dogroupexit+0x37/0xa0 x64sysexitgroup+0x18/0x20 dosyscall64+0x38/0x80
-> #0 (srcu){.+.+}-{0:0}: lockacquire+0x1521/0x2510 locksync+0x5f/0x90 synchronizesrcu+0x4f/0x1a0 mmunotifierrelease+0x128/0x240 exitmmap+0x6a/0x3a0 mmput+0x6a/0x120 svmrangedeferredlistwork+0x19f/0x350 [amdgpu] processonework+0x29b/0x560 workerthread+0x3d/0x3d0
other info that might help us debug this: Chain exists of: srcu --> &info->lock#2 --> (workcompletion)(&svms->deferredlistwork)
Possible unsafe locking scenario:
CPU0 CPU1 ---- ---- lock((workcompletion)(&svms->deferredlistwork)); lock(&info->lock#2); lock((workcompletion)(&svms->deferredlistwork)); sync(srcu);
Other sources
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix lock dependency warning with srcu
The Linux kernel CVE team has assigned CVE-2023-52632 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040218-CVE-2023-52632-f7bb@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.77 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.16 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52632?
CVE-2023-52632 has been classified as a moderate severity vulnerability.
How do I fix CVE-2023-52632?
To fix CVE-2023-52632, update your Linux kernel to the recommended versions, such as 6.1.77 or later.
What affected software is associated with CVE-2023-52632?
CVE-2023-52632 affects multiple versions of the Linux kernel across different distributions including Red Hat and Debian.
Is CVE-2023-52632 exploitable remotely?
CVE-2023-52632 is not known to be exploitable remotely; it primarily concerns local privileges.
What systems are at risk from CVE-2023-52632?
Systems running specific vulnerable versions of the Linux kernel, including certain releases of Red Hat and Debian, are at risk from CVE-2023-52632.