diff options
| author | Vladimir Marioukhine <Vladimir.Marioukhine@amd.com> | 2026-08-12 12:58:12 -0400 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2026-08-25 18:22:22 -0400 |
| commit | 6aa530642f95d5c48aa336416f94a35e7949b647 (patch) | |
| tree | f5c34f8232d80e1bcb858690e2d9cb2857ec0875 /scripts/const_structs.checkpatch | |
| parent | a04ea08ddb516f9f21f17574b6a2e7b540dfadf8 (diff) | |
| download | linux-6aa530642f95d5c48aa336416f94a35e7949b647.tar.gz linux-6aa530642f95d5c48aa336416f94a35e7949b647.zip | |
drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
Both create_queue_cpsch() and create_queue_nocpsch() unconditionally
call mqd_mgr->restore_mqd() when a CRIU restore is in progress
(qd != NULL), with no NULL guard. On any system where restore_mqd is
not implemented for the given queue type, a user holding
CAP_CHECKPOINT_RESTORE can trigger a kernel NULL pointer dereference
and panic the machine by issuing KFD_IOC_CRIU_OP_RESTORE with a
crafted queue restore object. Note that checkpoint_mqd is likewise
unimplemented on GFX12, so no legitimate CRIU image can reach this
path — only a hand-crafted restore payload.
Add a NULL guard for restore_mqd immediately after mqd_mgr is
resolved, unwinding via the existing error labels and returning
-EOPNOTSUPP if the callback is not implemented. This mirrors the
existing checkpoint_mqd guard in checkpoint_mqd().
Fixes: 48f0bdf4e38e ("drm/amdkfd: Added MQD manager files for GFX12.")
Cc: stable@vger.kernel.org
Signed-off-by: Vladimir Marioukhine <Vladimir.Marioukhine@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'scripts/const_structs.checkpatch')
0 files changed, 0 insertions, 0 deletions