Linux kernel (drivers/gpu/drm/vmwgfx): User-resource lookup during command submission used a broken RCU fast path, so

Impact

User-resource lookup during command submission used a broken RCU fast path, so two threads submitting command buffers against shared resources corrupt the lookup state and crash the kernel. The same race is a resource-lifetime bug, not just a crash: a tenant can drive the lookup to operate on a resource that is being torn down.

Who can reach it

A tenant process holding /dev/dri/renderD* on a vmwgfx device submits command buffers from two threads referencing shared surfaces - the upstream reproducer is the stock IGT vmwgfx execbuf stress test, so weaponizing it requires no novel research. Conditional on vmwgfx being the DRM driver (VMware-backed nodes).

What to do

Boot a kernel carrying the vmwgfx resource-locking fix below. Interim: withhold /dev/dri/* from untrusted tenants on VMware-backed nodes, or blacklist vmwgfx where guests do not need 3D or shared surfaces.

References