From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 11:14:21 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v6.1.179~64 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=f73b9782025aaba9b469f882ecb59fb28fa16ec2;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: drm-amdkfd-check-bounds-in-allocate_event_notification_slot.patch --- diff --git a/queue-6.6/drm-amdkfd-check-bounds-in-allocate_event_notification_slot.patch b/queue-6.6/drm-amdkfd-check-bounds-in-allocate_event_notification_slot.patch new file mode 100644 index 0000000000..bb1e229e17 --- /dev/null +++ b/queue-6.6/drm-amdkfd-check-bounds-in-allocate_event_notification_slot.patch @@ -0,0 +1,44 @@ +From bb52249fbbe948875155ccd45cd8d74bf4ae747b Mon Sep 17 00:00:00 2001 +From: David Francis +Date: Thu, 21 May 2026 09:18:59 -0400 +Subject: drm/amdkfd: Check bounds in allocate_event_notification_slot + +From: David Francis + +commit bb52249fbbe948875155ccd45cd8d74bf4ae747b upstream. + +The valid event ids go from 0 to KFD_SIGNAL_EVENT_LIMIT + +allocate_event_notification_slot has an option to specify +an event id to allocate at, used by CRIU. We weren't checking +the bounds on that value. + +Check them. + +v2: Lower bounds check is unecessary because of idr_alloc +already rejecting negative numbers. Upper bounds check should +be KFD_SIGNAL_EVENT_LIMIT since the signal mode mappings might +not yet exist + +Signed-off-by: David Francis +Reviewed-by: David Yat Sin +Signed-off-by: Alex Deucher +(cherry picked from commit 6853f1f6cbbeb3f53ebbbd7286536aeb2c5d5f50) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_events.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c +@@ -106,6 +106,9 @@ static int allocate_event_notification_s + } + + if (restore_id) { ++ if (*restore_id >= KFD_SIGNAL_EVENT_LIMIT) ++ return -EINVAL; ++ + id = idr_alloc(&p->event_idr, ev, *restore_id, *restore_id + 1, + GFP_KERNEL); + } else { diff --git a/queue-6.6/series b/queue-6.6/series index 0bc8e68f0f..d39d2b94c2 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -217,4 +217,5 @@ drm-nouveau-fix-reversed-error-cleanup-order-in-ucopy-functions.patch drm-i915-gem-add-missing-nospec-on-parallel-submit-slot.patch drm-nouveau-acr-fix-missing-nvkm_done-in-error-path-of-nvkm_acr_oneinit.patch drm-radeon-fix-r100_copy_blit-for-large-bos.patch +drm-amdkfd-check-bounds-in-allocate_event_notification_slot.patch drm-displayid-fix-tiled-display-topology-id-size.patch