CVE-2023-53545

A locking violation was found in the Linux kernel's AMD GPU driver in the context save area cleanup path. A local user can trigger this issue when closing GPU contexts, causing the driver to unmap and remove virtual memory mappings without first reserving the root page directory buffer object. This violates kernel locking rules and triggers lockdep warnings, potentially leading to system instability and denial of service.

AMD GPUs use a context save area (CSA) to preserve GPU state across context switches. When a process closes its GPU file descriptor, the cleanup code needs to unmap the CSA virtual address and remove it from the GPU's virtual memory system. The amdgpu_vm_bo_del function—which handles this unmapping—requires that the root page directory BO be reserved (locked) before it can safely modify the VM structure. However, the cleanup path in amdgpu_driver_postclose_kms was calling this function without holding the required lock. This creates a race condition window where concurrent GPU operations could be accessing the same VM structures. Lockdep immediately catches this violation and emits warnings. While the immediate symptom is warning messages, the underlying race could cause memory corruption or use-after-free conditions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the amdgpu module from being loaded. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.