CVE-2023-53351

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drm/sched: Check scheduler work queue before calling timeout handling

During an IGT GPU reset test we see again oops despite of

commit 0c8c901aaaebc9 (drm/sched: Check scheduler ready before calling

timeout handling).

It uses ready condition whether to call drm_sched_fault which unwind

the TDR leads to GPU reset.

However it looks the ready condition is overloaded with other meanings,

for example, for the following stack is related GPU reset :

0 gfx_v9_0_cp_gfx_start

1 gfx_v9_0_cp_gfx_resume

2 gfx_v9_0_cp_resume

3 gfx_v9_0_hw_init

4 gfx_v9_0_resume

5 amdgpu_device_ip_resume_phase2

does the following:

/* start the ring */

gfx_v9_0_cp_gfx_start(adev);

ring->sched.ready = true;

The same approach is for other ASICs as well :

gfx_v8_0_cp_gfx_resume

gfx_v10_0_kiq_resume, etc...

As a result, our GPU reset test causes GPU fault which calls unconditionally gfx_v9_0_fault

and then drm_sched_fault. However now it d

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References