]> git.ipfire.org Git - thirdparty/linux.git/commit
drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
authorAndrew Martin <andrew.martin@amd.com>
Thu, 28 May 2026 16:54:39 +0000 (12:54 -0400)
committerAlex Deucher <alexander.deucher@amd.com>
Wed, 3 Jun 2026 18:54:46 +0000 (14:54 -0400)
commit352ea59028ea48a6fff77f19ae28f98f71946a80
treed7395bfaef2d808b5516283902cbe0eac286124f
parent2bd550b547deabef98bd3b017ff743b7c34d3a6d
drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11

The v11 MQD manager incorrectly assigned the CP-compute variants of
checkpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA queues. These functions
use sizeof(struct v11_compute_mqd) (2048 bytes) instead of sizeof(struct
v11_sdma_mqd) (512 bytes), causing a 1536-byte overflow.

During CRIU checkpoint of an SDMA queue on Navi3x:
- checkpoint_mqd() reads 2048 bytes from a 512-byte SDMA MQD buffer,
  leaking 1536 bytes of adjacent GTT memory to userspace

During CRIU restore:
- restore_mqd() writes 2048 bytes into a 512-byte SDMA MQD buffer,
  corrupting 1536 bytes of adjacent GTT memory (often the ring buffer
  or neighboring MQDs)

This is a copy-paste regression unique to v11. All other ASIC backends
(cik, vi, v9, v10, v12) correctly use the SDMA-specific variants.

Add checkpoint_mqd_sdma() and restore_mqd_sdma() functions that properly
handle the smaller v11_sdma_mqd structure, matching the pattern used in
other MQD managers.

Fixes: cc009e613de6 ("drm/amdkfd: Add KFD support for soc21 v3")
Assisted-by: Claude:Sonnet 4-5
Signed-off-by: Andrew Martin <andrew.martin@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 6fa41db7ffdec97d62433adf03b7b9b759af8c2c)
Cc: stable@vger.kernel.org
drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c