Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment eop_ring_buffer_size in struct queue_properties is a u32. In kfd_queue_acquire_buffers() the expected EOP buffer size is computed as ALIGN(eop_ring_buffer_size, PAGE_SIZE); ALIGN uses typeof(x), so the addition is done in 32-bit. A user-supplied size of 0xFFFFF001 wraps to 0, causing kfd_queue_buffer_get() to skip its exact-size check (gated on size != 0) and accept any BO mapped at the address. On GFX8/GFX9 the MQD cp_hqd_eop_control is then programmed for an 8KB EOP ring backed by a 4KB BO, so CP EOP writes can land past the buffer and fault the GPU. Cast the operand to u64 so the alignment is computed in 64-bit; the size check in kfd_queue_buffer_get() then rejects the oversized request. (cherry picked from commit ae443117b742c357bfef3a7bddabf76fcf86e9ef)
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
ee0dc6c66a913260311876a4b2b53fe0b9bc3f94 to < 273548eb997c6be85230c1236b18784b09f6203caffectedacfc84cfa70aca5b970faf152979bc97b9f8b0c0 to < 6dc0b4b39ed4f11ef70f76ecea8537e35f45342baffected42ea9cf2f16b7131cb7302acb3dac510968f8bdc to < 7c54bd225d83bc1bcb44430ed4b4d3a5c36b1961affected42ea9cf2f16b7131cb7302acb3dac510968f8bdc to < 83463a96ea3c7d8ae636a4d6a0ba63c9ce410724affectedc6ce687077cc67e4f3cbd0c89cb356fbbce91f4caffected6.12.75 to < 6.12.103affected6.18.16 to < 6.18.44affected6.19.6 to < 6.20affected
Linux Linux
Default version status: affected
7.0affected0 to < 7.0unaffected6.12.103 to ≤ 6.12.*unaffected6.18.44 to ≤ 6.18.*unaffected7.1.8 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected