CVE-2026-80919: drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix recursive wwmutex acquire in amdgpudevcoredumpformat

When dumping IB contents from a hung job, amdgpudevcoredumpformat() acquired the VM root PD's reservation via amdgpuvmlockbypasid() and then, for each IB, called amdgpuboreserve() on the BO backing the IB. Both reservations are reservationwwclassmutex objects and neither used a wwacquirectx, which trips lockdep:

WARNING: possible recursive locking detected -------------------------------------------- kworker/u128:0 is trying to acquire lock: ffff88838b16e1f0 (reservationwwclassmutex){+.+.}-{4:4}, at: amdgpudevcoredumpformat+0x1594/0x23f0 [amdgpu]

but task is already holding lock: ffff8882f82681f0 (reservationwwclassmutex){+.+.}-{4:4}, at: amdgpudevcoredumpformat+0x1594/0x23f0 [amdgpu]

Possible unsafe locking scenario: CPU0 ---- lock(reservationwwclassmutex); lock(reservationwwclassmutex);

DEADLOCK May be due to missing lock nesting notation

Workqueue: eventsunbound amdgpudevcoredumpdeferredwork [amdgpu] Call Trace: wwmutexlock.constprop.0 wwmutexlock amdgpuboreserve amdgpudevcoredumpformat+0x1594 [amdgpu] amdgpudevcoredumpdeferredwork+0xea [amdgpu]

The two reservations are on different BOs in the captured trace, so the splat is a lockdep-correctness warning, not an observed deadlock. It becomes a real self-deadlock whenever the IB BO shares its dmaresv with the root PD (the always-valid case, see amdgpuvmisboalwaysvalid()): amdgpuboreserve(abo) re-acquires the same wwmutex without a ticket and blocks forever. With amdgpu.gpurecovery=0 the timeout handler refires every ~2 s and each invocation produces this splat, drowning the kernel ring buffer.

Now that amdgpuvmlockbypasid() takes a drmexec context, move the IB dumping into a separate helper that locks the root PD and every IB BO together in a single drmexec ticket. DRMEXECIGNOREDUPLICATES handles IB BOs that share a dmaresv (e.g. always-valid BOs, or two IBs backed by the same BO). Every lock is now a top-level acquire under one wwacquirectx, so the recursive wwmutex condition is gone, and the per-IB amdgpuboreserve()/amdgpubounref() dance -- including a BO refcount leak on the amdgpuboreserve() failure path -- is removed.

(cherry picked from commit d6bf4242731219ee08ce54c365631e395486651e)