drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size

Browse source

CRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size
from hardware without bounding it to the allocated BO region. If the HW
field is larger than the queue's control stack allocation, memcpy reads
past the BO into adjacent GTT memory and can leak kernel data to userspace.

Store the page-aligned control stack BO size in mqd_manager and clamp
checkpoint copies and reported checkpoint sizes to
min(cp_hqd_cntl_stack_size, mm->ctl_stack_size). Apply the same bound
for multi-XCC v9.4.3 checkpoint layout.

Signed-off-by: Yongqiang Sun <Yongqiang.Sun@amd.com>
Reviewed-by: David Francis <David.Francis@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 6c2abd0ec0)
Cc: stable@vger.kernel.org

...

This commit is contained in:

Yongqiang Sun 2026-06-02 09:47:19 -04:00 • committed by Alex Deucher

parent ea772a440d

commit 426ffae6ec

2 changed files with 23 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h

View file

25

drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c

View file