linux.git/drivers/gpu/drm/amd/amdkfd, branch master

drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger

2026-05-27T16:01:13+00:00

get_queue_ids() computes array_size = num_queues * sizeof(uint32_t),
which could overflow on 32-bit size_t build. using array_size()
instead, it saturates to SIZE_MAX on overflow.

Signed-off-by: Eric Huang 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
(cherry picked from commit 2d57a0475f085c08b49312dfd8edcb461845f285)
Cc: stable@vger.kernel.org

drm/amdkfd: Check for pdd drm file first in CRIU restore path

2026-05-27T15:59:24+00:00

CRIU restore ioctls are meant to be called by CRIU with no
existing drm file. There's an error path
for if the drm file unexpectedly exists. It was positioned so
it was missing a fput(drm_file).

Do that check earlier, as soon as we have the pdd.

Signed-off-by: David Francis 
Reviewed-by: Alex Deucher 
Signed-off-by: Alex Deucher 
(cherry picked from commit 2bab781dac78916c5cc8de76345a4102449267d7)
Cc: stable@vger.kernel.org

drm/amdkfd: fix NULL pointer bug in svm_range_set_attr

2026-05-27T15:57:49+00:00

The process_info could be NULL if user doesn't call kfd_ioctl_acquire_vm
before calling kfd_ioctl_svm.

Signed-off-by: Eric Huang 
Reviewed-by: Alex Deucher 
Signed-off-by: Alex Deucher 
(cherry picked from commit 83a26c812e0529eb040d31a76f73e33e637243d4)
Cc: stable@vger.kernel.org

drm/amdgpu: unmap all user mappings of framebuffer and doorbell before mode1 reset

2026-05-19T16:14:55+00:00

During Mode 1 reset, the ASIC undergoes a reset cycle and becomes temporarily
inaccessible via PCIe. Any attempt to access framebuffer or MMIO registers during
this window can result in uncompleted PCIe transactions, leading to NMI panics or
system hangs.

To prevent this, Unmap all of the applications mappings of the framebuffer
and doorbell BARs before mode1 reset. Also prevent new mappings from coming in
during the reset process.

v2: remove inode in kfd_dev (Christian)
v3: correct unmap offset (Felix), remove prevent new mappings part
to avoid deadlock (Christian)

Reviewed-by: Felix Kuehling 
Signed-off-by: Yifan Zhang 
Signed-off-by: Alex Deucher 
(cherry picked from commit 70cadefcc6160c575b04f763ada34c20e868d577)

drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id

2026-05-19T16:11:43+00:00

allocate_sdma_queue has an option where the sdma queue id can be
specified (used by CRIU). We weren't bounds-checking that
value.

Confirm it's less than the maximum number of queues.

Signed-off-by: David Francis 
Reviewed-by: Harish Kasiviswanathan 
Signed-off-by: Alex Deucher 
(cherry picked from commit bfe9a7545b2a7be1c543f1741e16f2d5ec4116ae)

drm/amdkfd: Check bounds on allocate_doorbell

2026-05-19T16:11:26+00:00

allocated_doorbell has an option to set the doorbell id
to a specific value (used by CRIU). This value was not
bounds checked.

Check to confirm it's less than KFD_MAX_NUM_OF_QUEUES_PER_PROCESS.

Signed-off-by: David Francis 
Reviewed-by: Harish Kasiviswanathan 
Signed-off-by: Alex Deucher 
(cherry picked from commit 1f087bb8cf9e8797633da35c85435e557ef74d06)

drm/amdkfd: Fix OOB memory exposure in get_wave_state()

2026-05-19T16:10:04+00:00

The get_wave_state() function for v9 trusts cp_hqd_cntl_stack_size and
cp_hqd_cntl_stack_offset values read directly from the MQD, which are
written by GPU microcode and fully attacker-controlled on the
CRIU-restore path (via AMDKFD_IOC_RESTORE_PROCESS with H3).

this leads to an unbounded copy_to_user() that can leak adjacent
GTT/kernel memory. If offset > size, integer underflow produces a ~4 GiB
read length, if size is set to 1 MiB against a 4 KiB allocation, we leak
1 MiB of adjacent kernel memory (other queues' MQDs, ring buffers, KASLR
pointers).

Fix by clamping both cp_hqd_cntl_stack_size to the actual allocated
buffer size (q->ctl_stack_size) and cp_hqd_cntl_stack_offset to the
clamped size before performing arithmetic and copy_to_user().

This ensures we never read beyond the allocated kernel BO regardless of
attacker-supplied MQD field values.

Signed-off-by: Sunday Clement 
Acked-by: Alex Deucher 
Signed-off-by: Alex Deucher 
(cherry picked from commit 7ef144458f48d5589e36f1b3d83e83db2e5c5ba5)

drm/amdkfd: Check if there are kfd porcesses using adev by kfd_processes_count

2026-05-05T14:18:23+00:00

During gpu hot-unplug need check if there are kfd porcesses still using the
being removed gpu before clean resources of the device. Current driver checks
if kfd_processes_table is empty. kfd processes are not terminated after
removed from kfd_processes_table immediately. They are still alive and may
access the device until kfd_process_wq work queue got ran.

Check kfd->kfd_processes_count value that is updated after kfd process got
uninitialized when its ref becomes zero.

Fixes: 6cca686dfce7 ("drm/amdkfd: kfd driver supports hot unplug/replug amdgpu devices")
Signed-off-by: Xiaogang Chen 
Reviewed-by: Felix Kuehling 
Signed-off-by: Alex Deucher 
(cherry picked from commit d12d05c4bc4c15585130af43e897923ff292df7b)

drm/amdkfd: Make all TLB-flushes heavy-weight

2026-05-05T14:13:54+00:00

With only one sequence number we cannot track the need for legacy vs
heavy-weight flushes reliably. Always use heavy-weight.

Signed-off-by: Felix Kuehling 
Reviewed-by: Philip Yang 
Signed-off-by: Alex Deucher 
(cherry picked from commit c1a3ff1d327820cd9a52bc1056b98681fc088949)
Cc: stable@vger.kernel.org

drm/amdkfd: check if vm ready in svm map and unmap to gpu

2026-04-24T15:12:07+00:00

Don't map or unmap svm range to gpu if vm is not ready for updates.

Why: DRM entity may already be killed when the svm worker try to
update gpu vm.

Signed-off-by: YuanShang 
Reviewed-by: Philip Yang 
Signed-off-by: Alex Deucher 
(cherry picked from commit 55f8e366c326980174a4f2b9501b524d8eb25135)