CVE-2026-68273: drm/amdgpu: Fix context pstate override handling

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix context pstate override handling

There are several problems in the context pstate handling code.

The most serious ones are potential use-after-free and NULL pointer
dereferences at context initialization time. Both are due
amdgpu_ctx_init() not holding the adev->pm.stable_pstate_ctx_lock, which
is otherwise used from both sysfs and the context code itself for
modifying and clearing the stored context pointer.

Second issue is that context fini can trample over the pstate
configuration set via sysfs. This is due the restore state
(ctx->stable_pstate) being saved at context init time, and not if, or when
the context actually changes the pstate. As the context exits it will
therefore incorrectly restore to what was set before the sysfs override
was requested.

The simplest fix is to drastically simplify how the state is tracked, by
clearly defining the points at which pstate ownership is taken and
released, and to handle all transitions under the correct lock.

Instead of at context init time, the previous state is saved only at the
point the context overrides the current state, and is restored on context
exit only if the context is still the owner of the current override state.

(cherry picked from commit 1b5e413713c0a93bc1818394d0ce49aaad21bd27)

The Linux kernel CVE team has assigned CVE-2026-68273 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.1 with commit 79610d3041338dc1ef554d6fd8b3b3e23be527f5 and fixed in 6.12.103 with commit 23a8726e1d7597fe7c9a59d5dc42ba8b7d345b8a
	Issue introduced in 6.1 with commit 79610d3041338dc1ef554d6fd8b3b3e23be527f5 and fixed in 6.18.44 with commit e06c39cc1c48dca68a5ffd971c23025a52d46634
	Issue introduced in 6.1 with commit 79610d3041338dc1ef554d6fd8b3b3e23be527f5 and fixed in 7.1.6 with commit 9f9c88eb298c54348be3ca4087f4f4c615065b87
	Issue introduced in 6.1 with commit 79610d3041338dc1ef554d6fd8b3b3e23be527f5 and fixed in 7.2-rc1 with commit c1dc4ccb82c9e56325d8e7514ca4c90bd1efb351
	Issue introduced in 6.0.7 with commit 6607901fce79959130db485e7549dacaaeef034e

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68273
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/23a8726e1d7597fe7c9a59d5dc42ba8b7d345b8a
	https://git.kernel.org/stable/c/e06c39cc1c48dca68a5ffd971c23025a52d46634
	https://git.kernel.org/stable/c/9f9c88eb298c54348be3ca4087f4f4c615065b87
	https://git.kernel.org/stable/c/c1dc4ccb82c9e56325d8e7514ca4c90bd1efb351