drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()

Browse source

[ Upstream commit 8a70a26c9f ]

The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8
bytes via memset without checking the buffer size parameter. This allows
unprivileged userspace to trigger an out-of bounds kernel memory write
by passing a small buffer, leading to  potential privilege
escalation.

Signed-off-by: Sunday Clement <Sunday.Clement@amd.com>
Reviewed-by: Alexander Deucher <Alexander.Deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Sunday Clement 2026-02-02 12:41:39 -05:00 • committed by Sasha Levin

parent 43bc12f6d6

commit 75fb57efdd

1 changed files with 6 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

6

drivers/gpu/drm/amd/amdkfd/kfd_events.c

View file