ACK: [SRU][J][PATCH 0/1] CVE-2022-50303

[Andrei Gherzan]

On 2026/09/18 07:27PM, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2022-50303
> 
> [ Impact ]
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> drm/amdkfd: Fix double release compute pasid
> 
> If kfd_process_device_init_vm returns failure after vm is converted to compute
> vm and vm->pasid set to compute pasid, KFD will not take pdd->drm_file
> reference. As a result, drm close file handler maybe called to release the
> compute pasid before KFD process destroy worker to release the same pasid and
> set vm->pasid to zero, this generates below WARNING backtrace and NULL pointer
> access.
> 
> Add helper amdgpu_amdkfd_gpuvm_set_vm_pasid and call it at the last step of
> kfd_process_device_init_vm, to ensure vm pasid is the original pasid if
> acquiring vm failed or is the compute pasid with pdd->drm_file reference taken
> to avoid double release same pasid.
> 
> amdgpu: Failed to create process VM object ida_free called for id=32770 which
> is not allocated. WARNING: CPU: 57 PID: 72542 at ../lib/idr.c:522
> ida_free+0x96/0x140 RIP: 0010:ida_free+0x96/0x140 Call Trace:
> amdgpu_pasid_free_delayed+0xe1/0x2a0 [amdgpu]
> amdgpu_driver_postclose_kms+0x2d8/0x340 [amdgpu]
> drm_file_free.part.13+0x216/0x270 [drm] drm_close_helper.isra.14+0x60/0x70
> [drm] drm_release+0x6e/0xf0 [drm] __fput+0xcc/0x280 ____fput+0xe/0x20
> task_work_run+0x96/0xc0 do_exit+0x3d0/0xc10
> 
> BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP:
> 0010:ida_free+0x76/0x140 Call Trace: amdgpu_pasid_free_delayed+0xe1/0x2a0
> [amdgpu] amdgpu_driver_postclose_kms+0x2d8/0x340 [amdgpu]
> drm_file_free.part.13+0x216/0x270 [drm] drm_close_helper.isra.14+0x60/0x70
> [drm] drm_release+0x6e/0xf0 [drm] __fput+0xcc/0x280 ____fput+0xe/0x20
> task_work_run+0x96/0xc0 do_exit+0x3d0/0xc10
> 
> [ Fix ]
> 
> jammy/linux: backported from 1a799c4c190e
> 
> The backport adapts the upstream change to this tree's older KFD API: both the
> new and changed functions take struct kgd_dev *kgd (via
> get_amdgpu_device(kgd)) instead of struct amdgpu_device *adev, and the caller
> passes dev->kgd. The err_set_pasid path drops the nonexistent
> kfd_process_device_destroy_cwsr_dgpu()/destroy_ib_mem() calls and falls
> through to this tree's kfd_process_device_free_bos()+drm_priv=NULL teardown,
> matching err_init_cwsr's existing cleanup.
> 
> [ Test Plan ]
> 
> Build and boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A bad fix would be confined to the amdgpu/amdkfd compute (ROCm/KFD) path on
> systems with AMD GPUs, specifically when a process sets up its per-device
> compute VM and PASID; a regression could surface as failures opening compute
> contexts or as new PASID lifetime issues on those GPUs. Systems without AMD
> GPUs, and AMD GPU users who only run graphics/display workloads without the
> KFD compute stack, are not affected.
> 
> [ Other Info ]
> 
> Kybele flow-v12-14-g7bcc3c7e. Reference: db2e4ad7/v1

Acked-by: Andrei Gherzan <andrei.gherzan at canonical.com>

-- 
Andrei Gherzan
gpg: rsa4096/D4D94F67AD0E9640
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260921/73800ec2/attachment.sig>