Executive Summary

This vulnerability exists in the Linux kernel's drm/v3d component related to compute shader dispatch (CSD). When a compute shader dispatch is initiated, it encodes workgroup counts in three registers (CFG0..CFG2). If any of these counts is zero, it is invalid because the hardware interprets zero as 65536, while the user-space driver limits the maximum to 65535.

The issue arises when zeroed workgroup counts reach the dispatch path through an indirect CSD job, where the counts are only known after reading an indirect buffer and can legitimately be zero. Instead of being treated as a no-op, these zeroed counts could cause incorrect hardware processing.

The fix involves overwriting the indirect CSD job workgroup counts with those from the indirect buffer object, even if zeroed, and preventing the job from being submitted to hardware when any workgroup count is zero. This causes the job to complete immediately without running the shader.

Useful 0 Not Useful 0

Impact Analysis

If exploited or triggered, this vulnerability could cause the hardware to process invalid workgroup counts, potentially leading to unexpected behavior or resource misuse in the GPU compute shader dispatch.

Since zero counts are interpreted as very large values (65536), this could cause the hardware to perform unintended operations or consume excessive resources, possibly leading to system instability or denial of service conditions.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is resolved by skipping the submission of compute shader dispatch (CSD) jobs when any of the workgroup counts is zero, preventing invalid dispatches.

To mitigate this vulnerability immediately, ensure your Linux kernel is updated to a version that includes this fix, which prevents zeroed workgroup counts from being submitted to the hardware.

Useful 0 Not Useful 0