{
   "containers": {
      "cna": {
         "providerMetadata": {
            "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038"
         },
         "descriptions": [
            {
               "lang": "en",
               "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix lock dependency warning\n\n======================================================\nWARNING: possible circular locking dependency detected\n6.5.0-kfd-fkuehlin #276 Not tainted\n------------------------------------------------------\nkworker/8:2/2676 is trying to acquire lock:\nffff9435aae95c88 ((work_completion)(&svm_bo->eviction_work)){+.+.}-{0:0}, at: __flush_work+0x52/0x550\n\nbut task is already holding lock:\nffff9435cd8e1720 (&svms->lock){+.+.}-{3:3}, at: svm_range_deferred_list_work+0xe8/0x340 [amdgpu]\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-> #2 (&svms->lock){+.+.}-{3:3}:\n       __mutex_lock+0x97/0xd30\n       kfd_ioctl_alloc_memory_of_gpu+0x6d/0x3c0 [amdgpu]\n       kfd_ioctl+0x1b2/0x5d0 [amdgpu]\n       __x64_sys_ioctl+0x86/0xc0\n       do_syscall_64+0x39/0x80\n       entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\n-> #1 (&mm->mmap_lock){++++}-{3:3}:\n       down_read+0x42/0x160\n       svm_range_evict_svm_bo_worker+0x8b/0x340 [amdgpu]\n       process_one_work+0x27a/0x540\n       worker_thread+0x53/0x3e0\n       kthread+0xeb/0x120\n       ret_from_fork+0x31/0x50\n       ret_from_fork_asm+0x11/0x20\n\n-> #0 ((work_completion)(&svm_bo->eviction_work)){+.+.}-{0:0}:\n       __lock_acquire+0x1426/0x2200\n       lock_acquire+0xc1/0x2b0\n       __flush_work+0x80/0x550\n       __cancel_work_timer+0x109/0x190\n       svm_range_bo_release+0xdc/0x1c0 [amdgpu]\n       svm_range_free+0x175/0x180 [amdgpu]\n       svm_range_deferred_list_work+0x15d/0x340 [amdgpu]\n       process_one_work+0x27a/0x540\n       worker_thread+0x53/0x3e0\n       kthread+0xeb/0x120\n       ret_from_fork+0x31/0x50\n       ret_from_fork_asm+0x11/0x20\n\nother info that might help us debug this:\n\nChain exists of:\n  (work_completion)(&svm_bo->eviction_work) --> &mm->mmap_lock --> &svms->lock\n\n Possible unsafe locking scenario:\n\n       CPU0                    CPU1\n       ----                    ----\n  lock(&svms->lock);\n                               lock(&mm->mmap_lock);\n                               lock(&svms->lock);\n  lock((work_completion)(&svm_bo->eviction_work));\n\nI believe this cannot really lead to a deadlock in practice, because\nsvm_range_evict_svm_bo_worker only takes the mmap_read_lock if the BO\nrefcount is non-0. That means it's impossible that svm_range_bo_release\nis running concurrently. However, there is no good way to annotate this.\n\nTo avoid the problem, take a BO reference in\nsvm_range_schedule_evict_svm_bo instead of in the worker. That way it's\nimpossible for a BO to get freed while eviction work is pending and the\ncancel_work_sync call in svm_range_bo_release can be eliminated.\n\nv2: Use svm_bo_ref_unless_zero and explained why that's safe. Also\nremoved redundant checks that are already done in\namdkfd_fence_enable_signaling."
            }
         ],
         "affected": [
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "unaffected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "versions": [
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "7a70663ba02b",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "8b25d397162b",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "28d2d623d2fb",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "cb96e492d72d",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "47bf0f83fc86",
                     "status": "affected",
                     "versionType": "git"
                  }
               ]
            },
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "affected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "versions": [
                  {
                     "version": "5.15.149",
                     "lessThanOrEqual": "5.15.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.1.77",
                     "lessThanOrEqual": "6.1.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.6.16",
                     "lessThanOrEqual": "6.6.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.7.4",
                     "lessThanOrEqual": "6.7.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.8",
                     "lessThanOrEqual": "*",
                     "status": "unaffected",
                     "versionType": "original_commit_for_fix"
                  }
               ]
            }
         ],
         "references": [
            {
               "url": "https://git.kernel.org/stable/c/7a70663ba02bd4e19aea8d70c979eb3bd03d839d"
            },
            {
               "url": "https://git.kernel.org/stable/c/8b25d397162b0316ceda40afaa63ee0c4a97d28b"
            },
            {
               "url": "https://git.kernel.org/stable/c/28d2d623d2fbddcca5c24600474e92f16ebb3a05"
            },
            {
               "url": "https://git.kernel.org/stable/c/cb96e492d72d143d57db2d2bc143a1cee8741807"
            },
            {
               "url": "https://git.kernel.org/stable/c/47bf0f83fc86df1bf42b385a91aadb910137c5c9"
            }
         ],
         "title": "drm/amdkfd: Fix lock dependency warning",
         "x_generator": {
            "engine": "bippy-8df59b4913de"
         }
      }
   },
   "cveMetadata": {
      "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038",
      "cveID": "CVE-2024-26628",
      "requesterUserId": "gregkh@kernel.org",
      "serial": "1",
      "state": "PUBLISHED"
   },
   "dataType": "CVE_RECORD",
   "dataVersion": "5.0"
}