CVE-2026-68102: drm/amdgpu: fix aperture mapping leak

CVE-2026-68102: drm/amdgpu: fix aperture mapping leak

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix aperture mapping leak

amdgpu_pci_remove() calls drm_dev_unplug() before invoking the driver
fini routines. This causes drm_dev_enter() in amdgpu_ttm_fini() to
always return false, so iounmap(aper_base_kaddr) never runs on normal
driver unload, leaving an orphaned entry in the x86 PAT interval tree.

On connected_to_cpu hardware, the aperture is mapped write-back (WB) via
ioremap_cache(). On reload, IP discovery calls memremap(..., MEMREMAP_WC)
over the same range. The WC vs WB conflict causes:

  ioremap error for 0x..., requested 0x1, got 0x0
  amdgpu: discovery failed: -2

Fix by switching to devres-managed mappings so cleanup is guaranteed
regardless of drm_dev_enter() state:

- connected_to_cpu path: devm_memremap(MEMREMAP_WB). For
  IORESOURCE_SYSTEM_RAM ranges this takes the try_ram_remap() shortcut,
  returning __va(offset) from the existing kernel direct map. No new
  ioremap VA or PAT entry is created, so there is nothing to orphan.

- dGPU path: devm_ioremap_wc() registers iounmap() as a devres action,
  guaranteeing cleanup at device_del() time.

Also remove iounmap(aper_base_kaddr) from amdgpu_device_unmap_mmio()
since the mapping is now devres-owned.

v2: Remove redundant x86_64 guard (Lijo)

(cherry picked from commit d871e99879cb5fd1fa798b006b4888887e63a17a)

The Linux kernel CVE team has assigned CVE-2026-68102 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.13 with commit 9d0af8b4def0de6b734ec8db08e96da0458facb6 and fixed in 6.6.148 with commit 67bc3647e418e23dc0d17604bdba634a73de809f
	Issue introduced in 5.13 with commit 9d0af8b4def0de6b734ec8db08e96da0458facb6 and fixed in 6.12.101 with commit a343d028ad6c174da8dc6af560c51e6d140a6727
	Issue introduced in 5.13 with commit 9d0af8b4def0de6b734ec8db08e96da0458facb6 and fixed in 6.18.42 with commit 6405c4e75b3bcf0e72bd7a0ff5f1ed0c475e23aa
	Issue introduced in 5.13 with commit 9d0af8b4def0de6b734ec8db08e96da0458facb6 and fixed in 7.1.6 with commit f5988b5c300a32ff751724ffd33d5a8d5873e4a7
	Issue introduced in 5.13 with commit 9d0af8b4def0de6b734ec8db08e96da0458facb6 and fixed in 7.2-rc2 with commit ea772a440d56b285f4d491affac50ecd41f6b402

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68102
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
	drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/67bc3647e418e23dc0d17604bdba634a73de809f
	https://git.kernel.org/stable/c/a343d028ad6c174da8dc6af560c51e6d140a6727
	https://git.kernel.org/stable/c/6405c4e75b3bcf0e72bd7a0ff5f1ed0c475e23aa
	https://git.kernel.org/stable/c/f5988b5c300a32ff751724ffd33d5a8d5873e4a7
	https://git.kernel.org/stable/c/ea772a440d56b285f4d491affac50ecd41f6b402