Linux kernel (drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535): Nouveau's GSP RPC layer frees the caller's message

Impact

Nouveau's GSP RPC layer frees the caller's message container after sending the first fragment of a multi-fragment RPC, then keeps using it to send the rest. Every remaining fragment is a write through freed kernel memory on the control channel between the driver and GPU firmware - the path that carries object allocation and mapping requests on Turing-and-later NVIDIA GPUs.

Who can reach it

Reached indirectly by a tenant holding /dev/dri/renderD* on a nouveau-driven NVIDIA GPU: userspace ioctls that allocate objects or set up mappings generate GSP RPCs, and any request whose payload exceeds a single fragment takes the buggy path. Conditional on the open nouveau driver with GSP firmware (not the proprietary NVIDIA module).

What to do

Update to a kernel carrying the fix commits below. Interim: on nodes using the proprietary NVIDIA driver, ensure nouveau is blacklisted so the vulnerable path is not loaded at all; otherwise restrict /dev/dri access.

References