Linux kernel (drivers/gpu/drm/nouveau/nvkm/subdev/gsp): The driver miscalculates free space in the GSP firmware command

Impact

The driver miscalculates free space in the GSP firmware command ring when the write pointer wraps, and overwrites the RPC the GPU firmware is still reading. The firmware wedges on a corrupted request and the GPU is dead for every tenant on it until the node is rebooted.

Who can reach it

Indirect but tenant-driven: any tenant holding /dev/dri/renderD* on a GSP-firmware NVIDIA GPU under nouveau generates the RPC traffic (allocations, mappings, large requests) that wraps the ring, and a tenant issuing large or high-volume allocations makes the wrap case likely. Only applies where nouveau with GSP-RM is the driver, not the NVIDIA proprietary/open kernel module.

What to do

Update to a kernel carrying the fix (stable commits below; no fixed_in published). Interim: run the vendor kernel module rather than nouveau on shared GSP-class GPUs.

References