Executive brief
The AMD GPU driver (amdgpu) in the Linux kernel contained a locking logic error that could cause system hangs when dumping GPU crash diagnostics. When a GPU job fails and diagnostic information is captured, the driver could repeatedly try to acquire the same lock without proper coordination, causing the system to freeze indefinitely and potentially be unresponsive to user input or administrative recovery commands.
Technical details
The vulnerability is a recursive ww_mutex (wound-wait mutex) acquisition in amdgpu_devcoredump_format(). The function acquired the VM root PD's reservation and then, for each indirect buffer (IB), called amdgpu_bo_reserve() on the backing buffer object without using a common ww_acquire_ctx, violating wound-wait mutex semantics. This became a self-deadlock when an IB BO shared its dma_resv with the root PD (always-valid case), causing amdgpu_bo_reserve() to re-acquire the same mutex without a ticket, blocking forever. The fix consolidates IB dumping into a separate helper that locks the root PD and all IB BOs together in a single drm_exec ticket with DRM_EXEC_IGNORE_DUPLICATES to handle shared dma_resv, eliminating the recursive condition.
Affected products
- Linux Linux kernel affected versions not specified in advisory
Timeline
- 2026-09-09: disclosed
- 2026-09-09: patched: cherry-picked from commit d6bf4242731219ee08ce54c365631e395486651e