Linux Kernel AMDGPU GART Table Initialization Vulnerability

A vulnerability in the Linux kernel's AMDGPU driver related to the Graphics Address Remapping Table (GART) has been addressed. The issue arose because the GART Translation Lookaside Buffer (TLB) is flushed after unmapping but not after mapping. The function 'amdgpu_bo_create_kernel()' failed to zero-initialize the buffer, leading to a situation where writing a single Page Table Entry (PTE) could cause the TLB to speculatively load other uninitialized entries from the same cache line. These garbage entries could be misinterpreted as valid, and a subsequent write to another PTE in the same cache line might result in the GPU using a stale, invalid PTE from the TLB. This vulnerability affects several versions of the Linux kernel.

Impact

The vulnerability could lead to the GPU incorrectly using stale data from the GART TLB, potentially causing erratic graphics behavior or errors in GPU-accelerated applications.

Reproduction

The vulnerability can be reproduced by allocating a GART table in VRAM without proper initialization. When a PTE is written, the TLB may load uninitialized entries from the same cache line, which can then be mistakenly treated as valid. A subsequent write to another PTE in the same cache line can cause the GPU to use the stale, invalid entry from the TLB.

Remediation

The vulnerability has been fixed by modifying the GART table allocation function to include a step that zero-initializes the GART table with the appropriate flags immediately after allocation. This ensures that all entries are cleared before they can be used, preventing the TLB from loading any uninitialized data.