CVE-2026-68245: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()

The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only
valid while the lock is still being held. Once xa_unlock_irqrestore is
called and returned, the pointer is no longer under lock and is subject
to modification. Since, the caller still dereferences vm->task_info in
amdgpu_vm_get_task_info_vm() after the lock is removed, this causes a
use after unlock problem.

Remove the lifetime issue present in amdgpu_vm_get_task_info_pasid()
through removing the amdgpu_vm_get_vm_from_pasid() function from
amdgpu_vm.c and making the relevant code inline to hold the lock while
it is still in use.

(cherry picked from commit 9d01579f3f868b333acc901815972685989092c7)

The Linux kernel CVE team has assigned CVE-2026-68245 to this issue.


Affected and fixed versions
===========================

	Fixed in 6.12.101 with commit fe16a7e5336ae888751984e30c451fbf7cfa5df7
	Fixed in 6.18.42 with commit 1173190412fb9d12e7efce76734118d9712ff970
	Fixed in 7.1.6 with commit 5d5fb9124a2bba96a7807086d8fe0f7ce810d546
	Fixed in 7.2-rc3 with commit 04cc4aa3617b0ed67e859f91f09de5d896a46f3a

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68245
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/fe16a7e5336ae888751984e30c451fbf7cfa5df7
	https://git.kernel.org/stable/c/1173190412fb9d12e7efce76734118d9712ff970
	https://git.kernel.org/stable/c/5d5fb9124a2bba96a7807086d8fe0f7ce810d546
	https://git.kernel.org/stable/c/04cc4aa3617b0ed67e859f91f09de5d896a46f3a