Linux kernel (drivers/gpu/drm/nouveau/nvkm/core): Nouveau's per-client object tree had no locking at all, so concurrent

Impact

Nouveau's per-client object tree had no locking at all, so concurrent object creation and destruction - most visibly VRAM BAR mappings - corrupts the tree. The reported crash is a general protection fault on a wild pointer during object lookup, which is the signature of an attacker-influenceable dangling pointer in the object namespace that backs GPU memory mappings.

Who can reach it

An unprivileged multi-threaded process in a container holding /dev/dri/renderD* on a nouveau-driven GPU races object allocation against object free; the crash was reproduced by a plain Vulkan conformance run, so no exotic ioctl sequence is needed. Conditional on the open nouveau driver being the one bound to the GPU.

What to do

Update to a kernel with the fix commits below, which adds locking around the client object tree. Interim: blacklist nouveau where the proprietary NVIDIA driver is used, and otherwise keep /dev/dri away from untrusted tenants.

References