[SRU][J][PATCH 0/1] CVE-2022-50303

[Cengiz Can]

https://ubuntu.com/security/CVE-2022-50303

[ Impact ]

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix double release compute pasid

If kfd_process_device_init_vm returns failure after vm is converted to compute
vm and vm->pasid set to compute pasid, KFD will not take pdd->drm_file
reference. As a result, drm close file handler maybe called to release the
compute pasid before KFD process destroy worker to release the same pasid and
set vm->pasid to zero, this generates below WARNING backtrace and NULL pointer
access.

Add helper amdgpu_amdkfd_gpuvm_set_vm_pasid and call it at the last step of
kfd_process_device_init_vm, to ensure vm pasid is the original pasid if
acquiring vm failed or is the compute pasid with pdd->drm_file reference taken
to avoid double release same pasid.

amdgpu: Failed to create process VM object ida_free called for id=32770 which
is not allocated. WARNING: CPU: 57 PID: 72542 at ../lib/idr.c:522
ida_free+0x96/0x140 RIP: 0010:ida_free+0x96/0x140 Call Trace:
amdgpu_pasid_free_delayed+0xe1/0x2a0 [amdgpu]
amdgpu_driver_postclose_kms+0x2d8/0x340 [amdgpu]
drm_file_free.part.13+0x216/0x270 [drm] drm_close_helper.isra.14+0x60/0x70
[drm] drm_release+0x6e/0xf0 [drm] __fput+0xcc/0x280 ____fput+0xe/0x20
task_work_run+0x96/0xc0 do_exit+0x3d0/0xc10

BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP:
0010:ida_free+0x76/0x140 Call Trace: amdgpu_pasid_free_delayed+0xe1/0x2a0
[amdgpu] amdgpu_driver_postclose_kms+0x2d8/0x340 [amdgpu]
drm_file_free.part.13+0x216/0x270 [drm] drm_close_helper.isra.14+0x60/0x70
[drm] drm_release+0x6e/0xf0 [drm] __fput+0xcc/0x280 ____fput+0xe/0x20
task_work_run+0x96/0xc0 do_exit+0x3d0/0xc10

[ Fix ]

jammy/linux: backported from 1a799c4c190e

The backport adapts the upstream change to this tree's older KFD API: both the
new and changed functions take struct kgd_dev *kgd (via
get_amdgpu_device(kgd)) instead of struct amdgpu_device *adev, and the caller
passes dev->kgd. The err_set_pasid path drops the nonexistent
kfd_process_device_destroy_cwsr_dgpu()/destroy_ib_mem() calls and falls
through to this tree's kfd_process_device_free_bos()+drm_priv=NULL teardown,
matching err_init_cwsr's existing cleanup.

[ Test Plan ]

Build and boot tested.

[ Where Problems Could Occur ]

A bad fix would be confined to the amdgpu/amdkfd compute (ROCm/KFD) path on
systems with AMD GPUs, specifically when a process sets up its per-device
compute VM and PASID; a regression could surface as failures opening compute
contexts or as new PASID lifetime issues on those GPUs. Systems without AMD
GPUs, and AMD GPU users who only run graphics/display workloads without the
KFD compute stack, are not affected.

[ Other Info ]

Kybele flow-v12-14-g7bcc3c7e. Reference: db2e4ad7/v1