CVE-2022-50303

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix double release compute pasid

If kfd_process_device_init_vm returns failure after vm is converted to

compute vm and vm->pasid set to compute pasid, KFD will not take

pdd->drm_file reference. As a result, drm close file handler maybe

called to release the compute pasid before KFD process destroy worker to

release the same pasid and set vm->pasid to zero, this generates below

WARNING backtrace and NULL pointer access.

Add helper amdgpu_amdkfd_gpuvm_set_vm_pasid and call it at the last step

of kfd_process_device_init_vm, to ensure vm pasid is the original pasid

if acquiring vm failed or is the compute pasid with pdd->drm_file

reference taken to avoid double release same pasid.

amdgpu: Failed to create process VM object

ida_free called for id=32770 which is not allocated.

WARNING: CPU: 57 PID: 72542 at ../lib/idr.c:522 ida_free+0x96/0x140

RIP: 0010:ida_free+0x96/0x140

Call Trace:

amdgpu_pasid_free

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References