Linux kernel (drivers/gpu/drm/nouveau): Calling the legacy pushbuf submission ioctl on a client that has VM_BIND

Impact

Calling the legacy pushbuf submission ioctl on a client that has VM_BIND enabled returns an error with the client mutex still held. The tenant's next ioctl and its file close both deadlock, leaving an unkillable task that pins GPU contexts and memory which never return to the pool for other tenants.

Who can reach it

Tenant container holding /dev/dri/renderD* on nouveau: enable VM_BIND on the client, then call DRM_IOCTL_NOUVEAU_GEM_PUSHBUF. One ioctl, deterministic, unprivileged - no race window to win.

What to do

Update to a kernel carrying the fix (stable commits below; no fixed_in published). Interim: none - both ioctls are on the normal submission interface; drain and reboot nodes with stuck nouveau clients.

References