Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion Userspace can pass an arbitrary number of BO list entries via the bo_number field. Although the previous multiplication overflow check prevents out-of-bounds allocation, a large number of entries could still cause excessive memory allocation (up to potentially gigabytes) and unnecessarily long list processing times. Introduce a hard limit of 128k entries per BO list, which is more than sufficient for any realistic use case (e.g., a single list containing all buffers in a large scene). This prevents memory exhaustion attacks and ensures predictable performance. Return -EINVAL if the requested entry count exceeds the limit (cherry picked from commit 688b87d39e0aa8135105b40dc167d74b5ada5332)
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to < c833d6c7199c5b5fca9ec95593acd539ec9c171caffectedd38ceaf99ed015f2a0b9af3499791bd3a3daae21 to < e620378aab78d415bd8a15a2f91c145906520288affectedd38ceaf99ed015f2a0b9af3499791bd3a3daae21 to < 2723e6851309531ce61aed74e93a0cd268cc862aaffectedd38ceaf99ed015f2a0b9af3499791bd3a3daae21 to < 5ce4a38e6c2488949e373d5066303f9c128db614affectedd38ceaf99ed015f2a0b9af3499791bd3a3daae21 to < f462624a6e4b5f1ec2664c2c53e408b2f4fb53e9affectedd38ceaf99ed015f2a0b9af3499791bd3a3daae21 to < 6270b1a5dab94665d7adce3dc78bc9066ed28bddaffected
Linux Linux
Default version status: affected
4.2affected0 to < 4.2unaffected6.1.175 to ≤ 6.1.*unaffected6.6.140 to ≤ 6.6.*unaffected6.12.86 to ≤ 6.12.*unaffected6.18.20 to ≤ 6.18.*unaffected6.19.10 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c833d6c7199c5b5fca9ec95593acd539ec9c171c ↗
- https://git.kernel.org/stable/c/e620378aab78d415bd8a15a2f91c145906520288 ↗
- https://git.kernel.org/stable/c/2723e6851309531ce61aed74e93a0cd268cc862a ↗
- https://git.kernel.org/stable/c/5ce4a38e6c2488949e373d5066303f9c128db614 ↗
- https://git.kernel.org/stable/c/f462624a6e4b5f1ec2664c2c53e408b2f4fb53e9 ↗
- https://git.kernel.org/stable/c/6270b1a5dab94665d7adce3dc78bc9066ed28bdd ↗