CyberRota Analysis
AI-GeneratedThe vulnerability in the Linux kernel affects the amdgpu driver, specifically in how it handles user-supplied command buffer sizes, which can lead to oversized submissions that corrupt adjacent control bits and destabilize command execution. This issue poses a risk of system instability and potential denial of service for systems utilizing affected GFX rings. Organizations using Linux systems with AMD GPUs should prioritize addressing this vulnerability to ensure system reliability and security.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through to ib->length_dw without a limit, while ring_emit_ib() encodes length into packet fields. Oversized values can corrupt adjacent control bits and destabilize command submission. Add a per-ring IB packet size limit helper and reject command submissions exceeding the corresponding dword limit before IB allocation. Use the documented 20-bit limit for GFX/compute/SDMA/VPE, and apply the MM fallback limit for other ring types. (cherry picked from commit 7f48fa2cf62e3fa6c9c3870aa74988f773247e52)