drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
authorSunday Clement <Sunday.Clement@amd.com>
Mon, 2 Feb 2026 17:41:39 +0000 (12:41 -0500)
committerAlex Deucher <alexander.deucher@amd.com>
Thu, 5 Feb 2026 22:20:07 +0000 (17:20 -0500)
commit8a70a26c9f34baea6c3199a9862ddaff4554a96d
treeece547c5bee019bda7c3c40d459f8cf01d6e5d14
parent56423871e9eef1dd069bddef895207fa5ce275fe
drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()

The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8
bytes via memset without checking the buffer size parameter. This allows
unprivileged userspace to trigger an out-of bounds kernel memory write
by passing a small buffer, leading to  potential privilege
escalation.

Signed-off-by: Sunday Clement <Sunday.Clement@amd.com>
Reviewed-by: Alexander Deucher <Alexander.Deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
drivers/gpu/drm/amd/amdkfd/kfd_events.c