]> git.ipfire.org Git - thirdparty/linux.git/commit
drm/amdkfd: Add bounds check for AMDKFD_IOC_WAIT_EVENTS
authorSunday Clement <Sunday.Clement@amd.com>
Tue, 19 May 2026 14:02:30 +0000 (10:02 -0400)
committerAlex Deucher <alexander.deucher@amd.com>
Thu, 4 Jun 2026 20:00:11 +0000 (16:00 -0400)
commit9c6ffdb41fa5dcf47a262c656e9f443d0d26049c
treeb45a0a79263c711cf99301209df6cea5214c1175
parent40396ffdf6120e2380706c59e1a84d7e765a37b6
drm/amdkfd: Add bounds check for AMDKFD_IOC_WAIT_EVENTS

The kfd_wait_on_events ioctl passes a user-supplied num_events parameter
directly to alloc_event_waiters() which calls kcalloc() without validation.
This allows unprivileged users with /dev/kfd access to trigger large kernel
memory allocations, potentially causing memory exhaustion and denial of
service via the OOM killer.

Add a check to reject num_events values exceeding KFD_SIGNAL_EVENT_LIMIT
(4096), which is the maximum number of events a single process can create.

Signed-off-by: Sunday Clement <Sunday.Clement@amd.com>
Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 39eb6da7acee8d0cc12a8959235b590f295d7b4c)
drivers/gpu/drm/amd/amdkfd/kfd_events.c