FlawAtlas
Search the atlas
UBUNTU-CVE-2024-58018 Moderate

UBUNTU-CVE-2024-58018

In the Linux kernel, the following vulnerability has been resolved: nvkm: correctly calculate the available space of the GSP cmdq buffer r535_gsp_cmdq_push() waits for the available page in the GSP cmdq buffer when handling a large RPC request. When it sees at least one available page in the cmdq, it quits the waiting with the amount of free buffer pages in the queue. Unfortunately, it always takes the [write pointer, buf_size) as available buffer pages before rolling back and wrongly calculates the size of the data should be copied. Thus, it can overwrite the RPC request that GSP is currently reading, which causes GSP hang due to corrupted RPC request: [ 549.209389] ------------[ cut here ]------------ [ 549.214010] WARNING: CPU: 8 PID: 6314 at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:116 r535_gsp_msgq_wait+0xd0/0x190 [nvkm] [ 549.225678] Modules linked in: nvkm(E+) gsp_log(E) snd_seq_dummy(E) snd_hrtimer(E) snd_seq(E) snd_timer(E) snd_seq_device(E) snd(E) soundcore(E) rfkill(E) qrtr(E) vfat(E) fat(E) ipmi_ssif(E) amd_atl(E) intel_rapl_msr(E) intel_rapl_common(E) mlx5_ib(E) amd64_edac(E) edac_mce_amd(E) kvm_amd(E) ib_uverbs(E) kvm(E) ib_core(E) acpi_ipmi(E) ipmi_si(E) mxm_wmi(E) ipmi_devintf(E) rapl(E) i2c_piix4(E) wmi_bmof(E) joydev(E) ptdma(E) acpi_cpufreq(E) k10temp(E) pcspkr(E) ipmi_msghandler(E) xfs(E) libcrc32c(E) ast(E) i2c_algo_bit(E) crct10dif_pclmul(E) drm_shmem_helper(E) nvme_tcp(E) crc32_pclmul(E) ahci(E) drm_kms_helper(E) libahci(E) nvme_fabrics(E) crc32c_intel(E) nvme(E) cdc_ether(E) mlx5_core(E) nvme_core(E) usbnet(E) drm(E) libata(E) ccp(E) ghash_clmulni_intel(E) mii(E) t10_pi(E) mlxfw(E) sp5100_tco(E) psample(E) pci_hyperv_intf(E) wmi(E) dm_multipath(E) sunrpc(E) dm_mirror(E) dm_region_hash(E) dm_log(E) dm_mod(E) be2iscsi(E) bnx2i(E) cnic(E) uio(E) cxgb4i(E) cxgb4(E) tls(E) libcxgbi(E) libcxgb(E) qla4xxx(E) [ 549.225752] iscsi_boot_sysfs(E) iscsi_tcp(E) libiscsi_tcp(E) libiscsi(E) scsi_transport_iscsi(E) fuse(E) [last unloaded: gsp_log(E)] [ 549.326293] CPU: 8 PID: 6314 Comm: insmod Tainted: G E 6.9.0-rc6+ #1 [ 549.334039] Hardware name: ASRockRack 1U1G-MILAN/N/ROMED8-NL, BIOS L3.12E 09/06/2022 [ 549.341781] RIP: 0010:r535_gsp_msgq_wait+0xd0/0x190 [nvkm] [ 549.347343] Code: 08 00 00 89 da c1 e2 0c 48 8d ac 11 00 10 00 00 48 8b 0c 24 48 85 c9 74 1f c1 e0 0c 4c 8d 6d 30 83 e8 30 89 01 e9 68 ff ff ff <0f> 0b 49 c7 c5 92 ff ff ff e9 5a ff ff ff ba ff ff ff ff be c0 0c [ 549.366090] RSP: 0018:ffffacbccaaeb7d0 EFLAGS: 00010246 [ 549.371315] RAX: 0000000000000000 RBX: 0000000000000012 RCX: 0000000000923e28 [ 549.378451] RDX: 0000000000000000 RSI: 0000000055555554 RDI: ffffacbccaaeb730 [ 549.385590] RBP: 0000000000000001 R08: ffff8bd14d235f70 R09: ffff8bd14d235f70 [ 549.392721] R10: 0000000000000002 R11: ffff8bd14d233864 R12: 0000000000000020 [ 549.399854] R13: ffffacbccaaeb818 R14: 0000000000000020 R15: ffff8bb298c67000 [ 549.406988] FS: 00007f5179244740(0000) GS:ffff8bd14d200000(0000) knlGS:0000000000000000 [ 549.415076] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 549.420829] CR2: 00007fa844000010 CR3: 00000001567dc005 CR4: 0000000000770ef0 [ 549.427963] PKRU: 55555554 [ 549.430672] Call Trace: [ 549.433126] <TASK> [ 549.435233] ? __warn+0x7f/0x130 [ 549.438473] ? r535_gsp_msgq_wait+0xd0/0x190 [nvkm] [ 549.443426] ? report_bug+0x18a/0x1a0 [ 549.447098] ? handle_bug+0x3c/0x70 [ 549.450589] ? exc_invalid_op+0x14/0x70 [ 549.454430] ? asm_exc_invalid_op+0x16/0x20 [ 549.458619] ? r535_gsp_msgq_wait+0xd0/0x190 [nvkm] [ 549.463565] r535_gsp_msg_recv+0x46/0x230 [nvkm] [ 549.468257] r535_gsp_rpc_push+0x106/0x160 [nvkm] [ 549.473033] r535_gsp_rpc_rm_ctrl_push+0x40/0x130 [nvkm] [ 549.478422] nvidia_grid_init_vgpu_types+0xbc/0xe0 [nvkm] [ 549.483899] nvidia_grid_init+0xb1/0xd0 [nvkm] [ 549.488420] ? srso_alias_return_thunk+0x5/0xfbef5 [ 549.493213] nvkm_device_pci_probe+0x305/0x420 [nvkm] [ 549.498338] local_pci_probe+0x46/ ---truncated---

Exploit probability Not scored
Published February 27, 2025
Required by Not available
Last source change August 19, 2026

02 / AFFECTED SOFTWARE

Affected packages

Ubuntu:22.04:LTS linux-starfive-6.5

11 explicit affected versions

Ubuntu:Pro:20.04:LTS linux-iot

53 explicit affected versions

Ubuntu:Pro:20.04:LTS linux-azure

116 explicit affected versions

Ubuntu:22.04:LTS linux-ibm

89 explicit affected versions

Ubuntu:18.04:LTS linux-oem

50 explicit affected versions

Ubuntu:18.04:LTS linux-aws-5.0

6 explicit affected versions

Ubuntu:20.04:LTS linux-aws-5.11

12 explicit affected versions

Ubuntu:22.04:LTS linux-oem-6.5

19 explicit affected versions

Ubuntu:20.04:LTS linux-raspi2

6 explicit affected versions

Ubuntu:22.04:LTS linux

100 explicit affected versions

Ubuntu:Pro:20.04:LTS linux-azure-fde-5.15

61 explicit affected versions

Ubuntu:24.04:LTS linux-riscv

24 explicit affected versions

Ubuntu:22.04:LTS linux-gkeop

85 explicit affected versions

Ubuntu:Pro:20.04:LTS linux-lowlatency-hwe-5.15

84 explicit affected versions

Ubuntu:Pro:FIPS-updates:20.04:LTS linux-fips

91 explicit affected versions

Ubuntu:22.04:LTS linux-azure

86 explicit affected versions

Ubuntu:Pro:20.04:LTS linux-gcp-5.15

76 explicit affected versions

Ubuntu:22.04:LTS linux-riscv-6.5

10 explicit affected versions

Ubuntu:22.04:LTS linux-ibm-6.8

17 explicit affected versions

Ubuntu:24.04:LTS linux-oem-6.8

24 explicit affected versions

Ubuntu:22.04:LTS linux-gke

90 explicit affected versions

Ubuntu:Pro:14.04:LTS linux

191 explicit affected versions

Ubuntu:22.04:LTS linux-azure-5.19

7 explicit affected versions

Ubuntu:22.04:LTS linux-raspi

84 explicit affected versions

Ubuntu:22.04:LTS linux-oracle-6.8

21 explicit affected versions

Ubuntu:22.04:LTS linux-gcp-6.5

13 explicit affected versions

Ubuntu:Pro:FIPS-updates:18.04:LTS linux-azure-fips

85 explicit affected versions

Ubuntu:24.04:LTS linux-nvidia

23 explicit affected versions

Ubuntu:20.04:LTS linux-oem-5.14

35 explicit affected versions

Ubuntu:Pro:FIPS-updates:22.04:LTS linux-gcp-fips

51 explicit affected versions

Ubuntu:22.04:LTS linux-nvidia-tegra

50 explicit affected versions

Ubuntu:20.04:LTS linux-gke-5.15

18 explicit affected versions

Ubuntu:Pro:FIPS-updates:22.04:LTS linux-azure-fips

42 explicit affected versions

Ubuntu:Pro:18.04:LTS linux-oracle

118 explicit affected versions

Ubuntu:22.04:LTS linux-azure-fde

64 explicit affected versions

Ubuntu:24.04:LTS linux-oracle

26 explicit affected versions

Ubuntu:Pro:18.04:LTS linux-hwe-5.4

120 explicit affected versions

Ubuntu:20.04:LTS linux-aws-5.13

13 explicit affected versions

Ubuntu:20.04:LTS linux-aws-5.8

4 explicit affected versions

Ubuntu:Pro:16.04:LTS linux-kvm

121 explicit affected versions

Ubuntu:16.04:LTS linux-hwe-edge

23 explicit affected versions

Ubuntu:24.04:LTS linux

31 explicit affected versions

Ubuntu:Pro:20.04:LTS linux-gcp

124 explicit affected versions

Ubuntu:Pro:FIPS:18.04:LTS linux-gcp-fips

1 explicit affected versions

Ubuntu:24.04:LTS linux-raspi-realtime

1 explicit affected versions

Ubuntu:20.04:LTS linux-hwe-5.8

21 explicit affected versions

Ubuntu:20.04:LTS linux-hwe-5.13

16 explicit affected versions

Ubuntu:22.04:LTS linux-lowlatency-hwe-6.2

10 explicit affected versions

Ubuntu:Pro:FIPS-updates:20.04:LTS linux-aws-fips

76 explicit affected versions

Ubuntu:24.04:LTS linux-aws

27 explicit affected versions

Ubuntu:24.04:LTS linux-hwe-6.11

5 explicit affected versions

Ubuntu:18.04:LTS linux-oracle-5.0

7 explicit affected versions

Ubuntu:20.04:LTS linux-riscv

12 explicit affected versions

Ubuntu:Pro:16.04:LTS linux-oracle

111 explicit affected versions

Ubuntu:24.04:LTS linux-azure-6.11

4 explicit affected versions

Ubuntu:20.04:LTS linux-gcp-5.11

12 explicit affected versions

Ubuntu:22.04:LTS linux-azure-6.5

14 explicit affected versions

Ubuntu:22.04:LTS linux-intel-iot-realtime

1 explicit affected versions

Ubuntu:20.04:LTS linux-intel-5.13

7 explicit affected versions

Ubuntu:24.04:LTS linux-nvidia-tegra

2 explicit affected versions

Ubuntu:Pro:18.04:LTS linux-azure-5.4

104 explicit affected versions

Ubuntu:20.04:LTS linux-oem-5.13

12 explicit affected versions

Ubuntu:Pro:20.04:LTS linux-raspi

105 explicit affected versions

Ubuntu:20.04:LTS linux-oracle-5.11

12 explicit affected versions

Ubuntu:Pro:Realtime:22.04:LTS linux-realtime-6.8

21 explicit affected versions

Ubuntu:Pro:14.04:LTS linux-aws

120 explicit affected versions

Ubuntu:22.04:LTS linux-nvidia-tegra-igx

45 explicit affected versions

Ubuntu:22.04:LTS linux-azure-6.8

18 explicit affected versions

Ubuntu:24.04:LTS linux-gkeop

13 explicit affected versions

Ubuntu:18.04:LTS linux-hwe-edge

10 explicit affected versions

Ubuntu:18.04:LTS linux-gke-5.4

37 explicit affected versions

Ubuntu:24.04:LTS linux-azure-nvidia

5 explicit affected versions

Ubuntu:22.04:LTS linux-oracle-6.5

13 explicit affected versions

Ubuntu:22.04:LTS linux-lowlatency-hwe-6.8

19 explicit affected versions

Ubuntu:22.04:LTS linux-azure-fde-6.2

10 explicit affected versions

Ubuntu:Pro:Realtime:22.04:LTS linux-intel-iot-realtime

68 explicit affected versions

Ubuntu:Pro:FIPS:20.04:LTS linux-aws-fips

1 explicit affected versions

Ubuntu:20.04:LTS linux-oem-5.10

26 explicit affected versions

Ubuntu:20.04:LTS linux-gcp-5.13

13 explicit affected versions

Ubuntu:Pro:16.04:LTS linux-aws

144 explicit affected versions

Ubuntu:22.04:LTS linux-xilinx-zynqmp

37 explicit affected versions

Ubuntu:Pro:FIPS:18.04:LTS linux-fips

1 explicit affected versions

Ubuntu:20.04:LTS linux-oem-5.6

29 explicit affected versions

Ubuntu:Pro:18.04:LTS linux-gcp-5.4

111 explicit affected versions

Ubuntu:18.04:LTS linux-gcp-5.3

13 explicit affected versions

Ubuntu:22.04:LTS linux-lowlatency

96 explicit affected versions

Ubuntu:24.04:LTS linux-nvidia-lowlatency

20 explicit affected versions

Ubuntu:22.04:LTS linux-gcp-6.8

21 explicit affected versions

Ubuntu:Pro:FIPS:18.04:LTS linux-azure-fips

1 explicit affected versions

Ubuntu:Pro:18.04:LTS linux-raspi-5.4

100 explicit affected versions

Ubuntu:22.04:LTS linux-aws

92 explicit affected versions

Ubuntu:Pro:FIPS-updates:22.04:LTS linux-aws-fips

55 explicit affected versions

Ubuntu:18.04:LTS linux-gke-4.15

33 explicit affected versions

Ubuntu:22.04:LTS linux-riscv

23 explicit affected versions

Ubuntu:Pro:20.04:LTS linux-ibm-5.15

60 explicit affected versions

Ubuntu:18.04:LTS linux-aws-5.3

10 explicit affected versions

Ubuntu:Pro:FIPS-updates:24.04:LTS linux-fips

1 explicit affected versions

Ubuntu:Pro:16.04:LTS linux

188 explicit affected versions

Ubuntu:Nvidia-BlueField:24.04:LTS linux-bluefield

11 explicit affected versions

Ubuntu:20.04:LTS linux-hwe-5.11

12 explicit affected versions

Ubuntu:20.04:LTS linux-azure-5.8

7 explicit affected versions

Ubuntu:22.04:LTS linux-gcp-6.2

12 explicit affected versions

Ubuntu:Pro:16.04:LTS linux-gcp

138 explicit affected versions

Ubuntu:Pro:FIPS:16.04:LTS linux-fips

2 explicit affected versions

Ubuntu:22.04:LTS linux-nvidia

77 explicit affected versions

Ubuntu:Pro:18.04:LTS linux-kvm

132 explicit affected versions

Ubuntu:22.04:LTS linux-oracle

93 explicit affected versions

Ubuntu:Pro:14.04:LTS linux-lts-xenial

165 explicit affected versions

Ubuntu:Pro:18.04:LTS linux

154 explicit affected versions

Ubuntu:22.04:LTS linux-lowlatency-hwe-5.19

10 explicit affected versions

Ubuntu:22.04:LTS linux-oem-5.17

26 explicit affected versions

Ubuntu:24.04:LTS linux-azure

25 explicit affected versions

Ubuntu:Pro:FIPS-preview:22.04:LTS linux-azure-fips

1 explicit affected versions

Ubuntu:Pro:20.04:LTS linux-intel-iotg-5.15

69 explicit affected versions

Ubuntu:22.04:LTS linux-hwe-6.8

14 explicit affected versions

Ubuntu:24.04:LTS linux-raspi

26 explicit affected versions

Ubuntu:22.04:LTS linux-azure-6.2

13 explicit affected versions

Ubuntu:24.04:LTS linux-ibm

26 explicit affected versions

Ubuntu:Pro:18.04:LTS linux-aws

139 explicit affected versions

Ubuntu:Pro:18.04:LTS linux-ibm-5.4

78 explicit affected versions

Ubuntu:22.04:LTS linux-oem-6.0

16 explicit affected versions

Ubuntu:22.04:LTS linux-kvm

91 explicit affected versions

Ubuntu:24.04:LTS linux-gcp

29 explicit affected versions

Ubuntu:Pro:16.04:LTS linux-aws-hwe

116 explicit affected versions

Ubuntu:22.04:LTS linux-azure-fde-5.19

3 explicit affected versions

Ubuntu:Pro:20.04:LTS linux

132 explicit affected versions

Ubuntu:Pro:18.04:LTS linux-gcp-4.15

93 explicit affected versions

Ubuntu:Pro:FIPS:20.04:LTS linux-azure-fips

1 explicit affected versions

Ubuntu:24.04:LTS linux-gcp-6.11

4 explicit affected versions

Ubuntu:Pro:FIPS-preview:22.04:LTS linux-aws-fips

2 explicit affected versions

Ubuntu:20.04:LTS linux-gke

51 explicit affected versions

Ubuntu:Pro:18.04:LTS linux-azure-4.15

92 explicit affected versions

Ubuntu:24.04:LTS linux-oem-6.11

13 explicit affected versions

Ubuntu:Pro:Realtime:24.04:LTS linux-raspi-realtime

23 explicit affected versions

Ubuntu:20.04:LTS linux-azure-5.13

12 explicit affected versions

Ubuntu:Pro:20.04:LTS linux-azure-5.15

71 explicit affected versions

Ubuntu:22.04:LTS linux-intel-iotg

80 explicit affected versions

Ubuntu:22.04:LTS linux-oem-6.1

27 explicit affected versions

Ubuntu:Nvidia-BlueField:22.04:LTS linux-bluefield

66 explicit affected versions

Ubuntu:Pro:20.04:LTS linux-oracle

121 explicit affected versions

Ubuntu:Pro:FIPS:18.04:LTS linux-aws-fips

1 explicit affected versions

Ubuntu:Pro:FIPS:20.04:LTS linux-fips

1 explicit affected versions

Ubuntu:Pro:FIPS-updates:18.04:LTS linux-fips

98 explicit affected versions

Ubuntu:22.04:LTS linux-nvidia-6.8

22 explicit affected versions

Ubuntu:22.04:LTS linux-gcp-5.19

8 explicit affected versions

Ubuntu:Pro:FIPS-updates:22.04:LTS linux-fips

55 explicit affected versions

Ubuntu:20.04:LTS linux-oracle-5.8

5 explicit affected versions

Ubuntu:22.04:LTS linux-riscv-5.19

8 explicit affected versions

Ubuntu:Pro:FIPS:20.04:LTS linux-gcp-fips

1 explicit affected versions

Ubuntu:22.04:LTS linux-hwe-6.2

10 explicit affected versions

Ubuntu:24.04:LTS linux-lowlatency-hwe-6.11

4 explicit affected versions

Ubuntu:Pro:Realtime:24.04:LTS linux-realtime

25 explicit affected versions

Ubuntu:22.04:LTS linux-lowlatency-hwe-6.5

13 explicit affected versions

Ubuntu:Pro:18.04:LTS linux-oracle-5.4

110 explicit affected versions

Ubuntu:20.04:LTS linux-azure-5.11

13 explicit affected versions

Ubuntu:Pro:FIPS-updates:20.04:LTS linux-azure-fips

72 explicit affected versions

Ubuntu:22.04:LTS linux-starfive-5.19

7 explicit affected versions

Ubuntu:Pro:16.04:LTS linux-azure

140 explicit affected versions

Ubuntu:24.04:LTS linux-nvidia-6.11

3 explicit affected versions

Ubuntu:Pro:FIPS-updates:18.04:LTS linux-aws-fips

94 explicit affected versions

Ubuntu:20.04:LTS linux-riscv-5.8

10 explicit affected versions

Ubuntu:20.04:LTS linux-oracle-5.13

12 explicit affected versions

Ubuntu:Pro:20.04:LTS linux-nvidia-tegra-5.15

39 explicit affected versions

Ubuntu:Pro:18.04:LTS linux-aws-5.4

108 explicit affected versions

Ubuntu:Pro:20.04:LTS linux-bluefield

80 explicit affected versions

Ubuntu:Pro:20.04:LTS linux-xilinx-zynqmp

56 explicit affected versions

Ubuntu:18.04:LTS linux-azure

44 explicit affected versions

Ubuntu:18.04:LTS linux-azure-5.3

16 explicit affected versions

Ubuntu:22.04:LTS linux-starfive-6.2

3 explicit affected versions

Ubuntu:20.04:LTS linux-riscv-5.11

13 explicit affected versions

Ubuntu:20.04:LTS linux-azure-fde

26 explicit affected versions

Ubuntu:20.04:LTS linux-gkeop-5.15

45 explicit affected versions

Ubuntu:18.04:LTS linux-gkeop-5.4

37 explicit affected versions

Ubuntu:24.04:LTS linux-lowlatency

30 explicit affected versions

Ubuntu:22.04:LTS linux-aws-6.5

14 explicit affected versions

Ubuntu:18.04:LTS linux-gcp

38 explicit affected versions

Ubuntu:Pro:16.04:LTS linux-hwe

167 explicit affected versions

Ubuntu:18.04:LTS linux-oracle-5.3

9 explicit affected versions

Ubuntu:22.04:LTS linux-hwe-5.19

11 explicit affected versions

Ubuntu:22.04:LTS linux-riscv-6.8

19 explicit affected versions

Ubuntu:24.04:LTS linux-xilinx

7 explicit affected versions

Ubuntu:22.04:LTS linux-gcp

92 explicit affected versions

Ubuntu:22.04:LTS linux-nvidia-6.2

7 explicit affected versions

Ubuntu:Pro:FIPS:16.04:LTS linux-fips

97 explicit affected versions

Ubuntu:Pro:14.04:LTS linux-azure

121 explicit affected versions

Ubuntu:20.04:LTS linux-gcp-5.8

4 explicit affected versions

Ubuntu:Pro:20.04:LTS linux-riscv-5.15

81 explicit affected versions

Ubuntu:24.04:LTS linux-realtime

1 explicit affected versions

Ubuntu:Pro:FIPS-preview:22.04:LTS linux-fips

1 explicit affected versions

Ubuntu:Pro:FIPS-preview:22.04:LTS linux-gcp-fips

1 explicit affected versions

Ubuntu:Pro:Realtime:22.04:LTS linux-realtime

91 explicit affected versions

Ubuntu:Pro:20.04:LTS linux-hwe-5.15

80 explicit affected versions

Ubuntu:Pro:20.04:LTS linux-aws-5.15

79 explicit affected versions

Ubuntu:22.04:LTS linux-hwe-6.5

13 explicit affected versions

Ubuntu:18.04:LTS linux-hwe

43 explicit affected versions

Ubuntu:Pro:FIPS-updates:20.04:LTS linux-gcp-fips

77 explicit affected versions

Ubuntu:Pro:20.04:LTS linux-kvm

119 explicit affected versions

Ubuntu:22.04:LTS linux-aws-5.19

10 explicit affected versions

Ubuntu:22.04:LTS linux-allwinner-5.19

8 explicit affected versions

Ubuntu:24.04:LTS linux-gke

24 explicit affected versions

Ubuntu:Pro:20.04:LTS linux-ibm

88 explicit affected versions

Ubuntu:22.04:LTS linux-aws-6.2

14 explicit affected versions

Ubuntu:18.04:LTS linux-azure-edge

4 explicit affected versions

Ubuntu:20.04:LTS linux-gkeop

78 explicit affected versions

Ubuntu:22.04:LTS linux-nvidia-6.5

11 explicit affected versions

Ubuntu:22.04:LTS linux-realtime

1 explicit affected versions

Ubuntu:Pro:FIPS-updates:18.04:LTS linux-gcp-fips

69 explicit affected versions

Ubuntu:Pro:20.04:LTS linux-aws

123 explicit affected versions

Ubuntu:22.04:LTS linux-aws-6.8

19 explicit affected versions

Ubuntu:Pro:20.04:LTS linux-oracle-5.15

80 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities UBUNTU-CVE-2024-58018

In the Linux kernel, the following vulnerability has been resolved: nvkm: correctly calculate the available space of the GSP cmdq buffer r535_gsp_cmdq_push() waits for the available page in the GSP cmdq buffer when handling a large RPC request. When it sees at least one available page in the cmdq, it quits the waiting with the amount of free buffer pages in the queue. Unfortunately, it always takes the [write pointer, buf_size) as available buffer pages before rolling back and wrongly calculates the size of the data should be copied. Thus, it can overwrite the RPC request that GSP is currently reading, which causes GSP hang due to corrupted RPC request: [ 549.209389] ------------[ cut here ]------------ [ 549.214010] WARNING: CPU: 8 PID: 6314 at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:116 r535_gsp_msgq_wait+0xd0/0x190 [nvkm] [ 549.225678] Modules linked in: nvkm(E+) gsp_log(E) snd_seq_dummy(E) snd_hrtimer(E) snd_seq(E) snd_timer(E) snd_seq_device(E) snd(E) soundcore(E) rfkill(E) qrtr(E) vfat(E) fat(E) ipmi_ssif(E) amd_atl(E) intel_rapl_msr(E) intel_rapl_common(E) mlx5_ib(E) amd64_edac(E) edac_mce_amd(E) kvm_amd(E) ib_uverbs(E) kvm(E) ib_core(E) acpi_ipmi(E) ipmi_si(E) mxm_wmi(E) ipmi_devintf(E) rapl(E) i2c_piix4(E) wmi_bmof(E) joydev(E) ptdma(E) acpi_cpufreq(E) k10temp(E) pcspkr(E) ipmi_msghandler(E) xfs(E) libcrc32c(E) ast(E) i2c_algo_bit(E) crct10dif_pclmul(E) drm_shmem_helper(E) nvme_tcp(E) crc32_pclmul(E) ahci(E) drm_kms_helper(E) libahci(E) nvme_fabrics(E) crc32c_intel(E) nvme(E) cdc_ether(E) mlx5_core(E) nvme_core(E) usbnet(E) drm(E) libata(E) ccp(E) ghash_clmulni_intel(E) mii(E) t10_pi(E) mlxfw(E) sp5100_tco(E) psample(E) pci_hyperv_intf(E) wmi(E) dm_multipath(E) sunrpc(E) dm_mirror(E) dm_region_hash(E) dm_log(E) dm_mod(E) be2iscsi(E) bnx2i(E) cnic(E) uio(E) cxgb4i(E) cxgb4(E) tls(E) libcxgbi(E) libcxgb(E) qla4xxx(E) [ 549.225752] iscsi_boot_sysfs(E) iscsi_tcp(E) libiscsi_tcp(E) libiscsi(E) scsi_transport_iscsi(E) fuse(E) [last unloaded: gsp_log(E)] [ 549.326293] CPU: 8 PID: 6314 Comm: insmod Tainted: G E 6.9.0-rc6+ #1 [ 549.334039] Hardware name: ASRockRack 1U1G-MILAN/N/ROMED8-NL, BIOS L3.12E 09/06/2022 [ 549.341781] RIP: 0010:r535_gsp_msgq_wait+0xd0/0x190 [nvkm] [ 549.347343] Code: 08 00 00 89 da c1 e2 0c 48 8d ac 11 00 10 00 00 48 8b 0c 24 48 85 c9 74 1f c1 e0 0c 4c 8d 6d 30 83 e8 30 89 01 e9 68 ff ff ff <0f> 0b 49 c7 c5 92 ff ff ff e9 5a ff ff ff ba ff ff ff ff be c0 0c [ 549.366090] RSP: 0018:ffffacbccaaeb7d0 EFLAGS: 00010246 [ 549.371315] RAX: 0000000000000000 RBX: 0000000000000012 RCX: 0000000000923e28 [ 549.378451] RDX: 0000000000000000 RSI: 0000000055555554 RDI: ffffacbccaaeb730 [ 549.385590] RBP: 0000000000000001 R08: ffff8bd14d235f70 R09: ffff8bd14d235f70 [ 549.392721] R10: 0000000000000002 R11: ffff8bd14d233864 R12: 0000000000000020 [ 549.399854] R13: ffffacbccaaeb818 R14: 0000000000000020 R15: ffff8bb298c67000 [ 549.406988] FS: 00007f5179244740(0000) GS:ffff8bd14d200000(0000) knlGS:0000000000000000 [ 549.415076] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 549.420829] CR2: 00007fa844000010 CR3: 00000001567dc005 CR4: 0000000000770ef0 [ 549.427963] PKRU: 55555554 [ 549.430672] Call Trace: [ 549.433126] <TASK> [ 549.435233] ? __warn+0x7f/0x130 [ 549.438473] ? r535_gsp_msgq_wait+0xd0/0x190 [nvkm] [ 549.443426] ? report_bug+0x18a/0x1a0 [ 549.447098] ? handle_bug+0x3c/0x70 [ 549.450589] ? exc_invalid_op+0x14/0x70 [ 549.454430] ? asm_exc_invalid_op+0x16/0x20 [ 549.458619] ? r535_gsp_msgq_wait+0xd0/0x190 [nvkm] [ 549.463565] r535_gsp_msg_recv+0x46/0x230 [nvkm] [ 549.468257] r535_gsp_rpc_push+0x106/0x160 [nvkm] [ 549.473033] r535_gsp_rpc_rm_ctrl_push+0x40/0x130 [nvkm] [ 549.478422] nvidia_grid_init_vgpu_types+0xbc/0xe0 [nvkm] [ 549.483899] nvidia_grid_init+0xb1/0xd0 [nvkm] [ 549.488420] ? srso_alias_return_thunk+0x5/0xfbef5 [ 549.493213] nvkm_device_pci_probe+0x305/0x420 [nvkm] [ 549.498338] local_pci_probe+0x46/ ---truncated---

View original source

05 / REFERENCES

Further evidence