CVE-2026-99106drm/amdgpu: free the userptr ranges when a CS fails after parser_bos

Official description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parser_bos amdgpu_cs_parser_bos() allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpu_cs_parser_bos() itself fails or when amdgpu_cs_submit() checks them under the notifier lock. If amdgpu_cs_patch_jobs(), amdgpu_cs_vm_handling(), amdgpu_cs_sync_rings() or the early part of amdgpu_cs_submit() fails, nothing frees them: neither amdgpu_cs_parser_fini() nor amdgpu_bo_list_free() touch e->range. Each such CS then leaks the range, its hmm_pfns array (8 bytes per page of the userptr BO) and the BO reference the range holds. An IB on a ring that patches the CS in place (e.g. VCN) with an unmapped va_start fails in amdgpu_cs_patch_ibs() and takes this path. Free the ranges on those error paths. Ranges amdgpu_cs_submit() already dropped are NULL, so freeing them again is a no-op. (cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267)

Affected packages & fixed versions

Affected products (as reported)

References

• https://git.kernel.org/stable/c/e265221019d20fa162b62baec16c44b5b2ea295b
• https://git.kernel.org/stable/c/79179efd1ad4729cf0ff9e15eb9414f883e4aec2
• https://git.kernel.org/stable/c/6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a
• https://git.kernel.org/stable/c/2d9d24385201f476a2f754495b71bbac5ba6ea7b
• https://git.kernel.org/stable/c/1b4da805a0ba354a549ce07459c871c17dd94fe0