From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5F43257EDA6 for ; Wed, 9 Sep 2026 16:13:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788970419; cv=none; b=T1VSrZK235IGtLxkCDttbYz96PBmfJ3M6BQbdSxZzUVj9FVToQE4ex1fA3/esqXPCej8Lwv6VxtVZMndM0W/X+yotJADj5OvznHTis/5twyUvgucj1OeKzsKtI5HdIBsg7hpHbTPDJntHp/HIoRuqIfrEcF59pY8p85j4a5iz9Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788970419; c=relaxed/simple; bh=uUssDiSVJlf5HtpE2xzYtV01qkAJ/TjSR6tOJquyLa0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=kbkXZ8ovFDOFHEXktsAb/a/DWwyQqlkxIA4g82wCY8oHn+wV9O4Ag7ZP0qqWQce/HEKBofRhqUuY/MXRcQmtLY1e4MzaVdk+ASbty6ROdDYFMwp1VP0KplkgXLI4O3KOpCZyU5obA5Kgim2eqH8GZEH8KWMe7w0+CulcQv6GZvs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=e7kjNmxo; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="e7kjNmxo" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6B3A11F00A3A; Wed, 9 Sep 2026 16:13:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1788970418; bh=tyEYQ3cjGwfuNzO2hf7QhwBIaVYnkr8kSgqre4W7ZjA=; h=From:To:Cc:Subject:Date:Reply-To; b=e7kjNmxo7eSLpNF7pPf8n20m0aMeAIBqxDsiD19MVhL9JAGSP+Gkd1FS01yTaCHlG +0h4tvyY9EfHRlg6RJEuiWo3zRiBcBH0/5rrbyHx40H7d0WZLZ/phqihCDFK+Pj7ex Lbucca5w9CGoIKwwNd0gU82LLA0UJ7/nqbLjpPtE= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-80919: drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format Date: Wed, 9 Sep 2026 18:13:19 +0200 Message-ID: <2026090915-CVE-2026-80919-6fae@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4196; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=3hN7bdyWlupCtjKbQ4sdZR9MPhySZCxjcbopTHOKNCQ=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkLW2efErvqMLXz99767IvGJmf7jL7futgtahbi9/UyR 94j1Ud7OmJZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAiup8Y5unY3pQ8cFximcRF yfRTn6Y9771xU55hfjoX0+Zj/OU7Xom94isKEGPSbChqAAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format When dumping IB contents from a hung job, amdgpu_devcoredump_format() acquired the VM root PD's reservation via amdgpu_vm_lock_by_pasid() and then, for each IB, called amdgpu_bo_reserve() on the BO backing the IB. Both reservations are reservation_ww_class_mutex objects and neither used a ww_acquire_ctx, which trips lockdep: WARNING: possible recursive locking detected -------------------------------------------- kworker/u128:0 is trying to acquire lock: ffff88838b16e1f0 (reservation_ww_class_mutex){+.+.}-{4:4}, at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu] but task is already holding lock: ffff8882f82681f0 (reservation_ww_class_mutex){+.+.}-{4:4}, at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu] Possible unsafe locking scenario: CPU0 ---- lock(reservation_ww_class_mutex); lock(reservation_ww_class_mutex); *** DEADLOCK *** May be due to missing lock nesting notation Workqueue: events_unbound amdgpu_devcoredump_deferred_work [amdgpu] Call Trace: __ww_mutex_lock.constprop.0 ww_mutex_lock amdgpu_bo_reserve amdgpu_devcoredump_format+0x1594 [amdgpu] amdgpu_devcoredump_deferred_work+0xea [amdgpu] The two reservations are on different BOs in the captured trace, so the splat is a lockdep-correctness warning, not an observed deadlock. It becomes a real self-deadlock whenever the IB BO shares its dma_resv with the root PD (the always-valid case, see amdgpu_vm_is_bo_always_valid()): amdgpu_bo_reserve(abo) re-acquires the same ww_mutex without a ticket and blocks forever. With amdgpu.gpu_recovery=0 the timeout handler refires every ~2 s and each invocation produces this splat, drowning the kernel ring buffer. Now that amdgpu_vm_lock_by_pasid() takes a drm_exec context, move the IB dumping into a separate helper that locks the root PD and every IB BO together in a single drm_exec ticket. DRM_EXEC_IGNORE_DUPLICATES handles IB BOs that share a dma_resv (e.g. always-valid BOs, or two IBs backed by the same BO). Every lock is now a top-level acquire under one ww_acquire_ctx, so the recursive ww_mutex condition is gone, and the per-IB amdgpu_bo_reserve()/amdgpu_bo_unref() dance -- including a BO refcount leak on the amdgpu_bo_reserve() failure path -- is removed. (cherry picked from commit d6bf4242731219ee08ce54c365631e395486651e) The Linux kernel CVE team has assigned CVE-2026-80919 to this issue. Affected and fixed versions =========================== Issue introduced in 7.1 with commit 7b15fc2d1f1a00fb99f0146e404ff2600999ec74 and fixed in 7.1.11 with commit 4e9b4dee0777ec9c835a4746e2d30382dd9d1044 Issue introduced in 7.1 with commit 7b15fc2d1f1a00fb99f0146e404ff2600999ec74 and fixed in 7.2 with commit 7152b248dc3c8d5fa8629e99ed5655dd41b51562 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-80919 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/4e9b4dee0777ec9c835a4746e2d30382dd9d1044 https://git.kernel.org/stable/c/7152b248dc3c8d5fa8629e99ed5655dd41b51562