CVE-2024-35795: drm/amdgpu: fix deadlock while reading mqd from debugfs
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix deadlock while reading mqd from debugfs
An errant disk backup on my desktop got into debugfs and triggered the following deadlock scenario in the amdgpu debugfs files. The machine also hard-resets immediately after those lines are printed (although I wasn't able to reproduce that part when reading by hand):
[ 1318.016074][ T1082] ====================================================== [ 1318.016607][ T1082] WARNING: possible circular locking dependency detected [ 1318.017107][ T1082] 6.8.0-rc7-00015-ge0c8221b72c0 #17 Not tainted [ 1318.017598][ T1082] ------------------------------------------------------ [ 1318.018096][ T1082] tar/1082 is trying to acquire lock: [ 1318.018585][ T1082] ffff98c44175d6a0 (&mm->mmaplock){++++}-{3:3}, at: mightfault+0x40/0x80 [ 1318.019084][ T1082] [ 1318.019084][ T1082] but task is already holding lock: [ 1318.020052][ T1082] ffff98c4c13f55f8 (reservationwwclassmutex){+.+.}-{3:3}, at: amdgpudebugfsmqdread+0x6a/0x250 [amdgpu] [ 1318.020607][ T1082] [ 1318.020607][ T1082] which lock already depends on the new lock. [ 1318.020607][ T1082] [ 1318.022081][ T1082] [ 1318.022081][ T1082] the existing dependency chain (in reverse order) is: [ 1318.023083][ T1082] [ 1318.023083][ T1082] -> #2 (reservationwwclassmutex){+.+.}-{3:3}: [ 1318.024114][ T1082] wwmutexlock.constprop.0+0xe0/0x12f0 [ 1318.024639][ T1082] wwmutexlock+0x32/0x90 [ 1318.025161][ T1082] dmaresvlockdep+0x18a/0x330 [ 1318.025683][ T1082] dooneinitcall+0x6a/0x350 [ 1318.026210][ T1082] kernelinitfreeable+0x1a3/0x310 [ 1318.026728][ T1082] kernelinit+0x15/0x1a0 [ 1318.027242][ T1082] retfromfork+0x2c/0x40 [ 1318.027759][ T1082] retfromforkasm+0x11/0x20 [ 1318.028281][ T1082] [ 1318.028281][ T1082] -> #1 (reservationwwclassacquire){+.+.}-{0:0}: [ 1318.029297][ T1082] dmaresvlockdep+0x16c/0x330 [ 1318.029790][ T1082] dooneinitcall+0x6a/0x350 [ 1318.030263][ T1082] kernelinitfreeable+0x1a3/0x310 [ 1318.030722][ T1082] kernelinit+0x15/0x1a0 [ 1318.031168][ T1082] retfromfork+0x2c/0x40 [ 1318.031598][ T1082] retfromforkasm+0x11/0x20 [ 1318.032011][ T1082] [ 1318.032011][ T1082] -> #0 (&mm->mmaplock){++++}-{3:3}: [ 1318.032778][ T1082] lockacquire+0x14bf/0x2680 [ 1318.033141][ T1082] lockacquire+0xcd/0x2c0 [ 1318.033487][ T1082] mightfault+0x58/0x80 [ 1318.033814][ T1082] amdgpudebugfsmqdread+0x103/0x250 [amdgpu] [ 1318.034181][ T1082] fullproxyread+0x55/0x80 [ 1318.034487][ T1082] vfsread+0xa7/0x360 [ 1318.034788][ T1082] ksysread+0x70/0xf0 [ 1318.035085][ T1082] dosyscall64+0x94/0x180 [ 1318.035375][ T1082] entrySYSCALL64afterhwframe+0x46/0x4e [ 1318.035664][ T1082] [ 1318.035664][ T1082] other info that might help us debug this: [ 1318.035664][ T1082] [ 1318.036487][ T1082] Chain exists of: [ 1318.036487][ T1082] &mm->mmaplock --> reservationwwclassacquire --> reservationwwclassmutex [ 1318.036487][ T1082] [ 1318.037310][ T1082] Possible unsafe locking scenario: [ 1318.037310][ T1082] [ 1318.037838][ T1082] CPU0 CPU1 [ 1318.038101][ T1082] ---- ---- [ 1318.038350][ T1082] lock(reservationwwclassmutex); [ 1318.038590][ T1082] lock(reservationwwclassacquire); [ 1318.038839][ T1082] lock(reservationwwclassmutex); [ 1318.039083][ T1082] rlock(&mm->mmaplock); [ 1318.039328][ T1082] [ 1318.039328][ T1082] DEADLOCK [ 1318.039328][ T1082] [ 1318.040029][ T1082] 1 lock held by tar/1082: [ 1318.040259][ T1082] #0: ffff98c4c13f55f8 (reservationwwclassmutex){+.+.}-{3:3}, at: amdgpudebugfsmqdread+0x6a/0x250 [amdgpu] [ 1318.040560][ T1082] [ 1318.040560][ T1082] stack backtrace: [ ---truncated---
Other sources
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix deadlock while reading mqd from debugfs
The Linux kernel CVE team has assigned CVE-2024-35795 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051734-CVE-2024-35795-ee3e@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35795?
CVE-2024-35795 has a low severity rating related to deadlocks in the amdgpu debugfs files in the Linux kernel.
How do I fix CVE-2024-35795?
To fix CVE-2024-35795, update your Linux kernel to versions 6.6.24, 6.7.12, 6.8.3, or 6.9, depending on your distribution.
Which Linux distributions are affected by CVE-2024-35795?
CVE-2024-35795 affects Linux distributions that use the impacted kernel versions, particularly Red Hat and Debian systems.
What is the impact of CVE-2024-35795 on my system?
CVE-2024-35795 can lead to deadlocks under specific conditions when interacting with amdgpu debugfs files, potentially causing system instability.
Is there a workaround for CVE-2024-35795?
There is no official workaround for CVE-2024-35795; the recommended solution is to apply the appropriate kernel update.