Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idr_alloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfd_criu_restore_event() -> create_signal_event() / create_other_event() -> allocate_event_notification_slot() -> idr_alloc(..., *restore_id, *restore_id + 1, ...) For BO restore: criu_restore_memory_of_gpu() -> idr_alloc(..., bo_priv->idr_handle, ...) In both cases, the restored ID comes from userspace-provided CRIU data. idr_alloc() expects the ID range values to fit within signed int limits. If a restored ID is larger than INT_MAX, it can trigger a WARN in the IDR layer. A kernel WARN is undesirable because it prints a warning trace and may cause a panic or reboot on systems with panic_on_warn enabled. Smatch reported these paths as allowing unchecked userspace values to reach idr_alloc(). Add INT_MAX validation before using restored IDs in: - kfd_criu_restore_event() - criu_restore_memory_of_gpu() If the restored ID is invalid, return -EINVAL. This prevents invalid restore data from reaching the IDR layer and avoids WARN-triggering paths, while keeping valid restore behavior unchanged.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 40e8a766a761f7fdc8530347527b344fddf6f1a8 before f8687018f24037056692c1e93c7d96cc72889d5b; affected 40e8a766a761f7fdc8530347527b344fddf6f1a8 before 89a75e3349c4fae28cbedc711bc924cbc6293da2; affected 40e8a766a761f7fdc8530347527b344fddf6f1a8 before 085ea93bda71fee600cc12a17026598eb10dd1f9; affected 40e8a766a761f7fdc8530347527b344fddf6f1a8 before 543ed0f61d56501cc585162da600bbedd7c08c0f; affected 40e8a766a761f7fdc8530347527b344fddf6f1a8 before cb6311f25a096621ac7ffd91b50d1bb1cfb63a96; affected 40e8a766a761f7fdc8530347527b344fddf6f1a8 before 85043dd49c2f51a37b22618168e3ae59ab92f0d6 |
| Linux / Linux | affected 5.18; unaffected 0 before 5.18; unaffected 6.1.178 through 6.1.*; unaffected 6.6.145 through 6.6.*; unaffected 6.12.97 through 6.12.*; unaffected 6.18.40 through 6.18.*; unaffected 7.1.5 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/f8687018f24037056692c1e93c7d96cc72889d5b
- https://git.kernel.org/stable/c/89a75e3349c4fae28cbedc711bc924cbc6293da2
- https://git.kernel.org/stable/c/085ea93bda71fee600cc12a17026598eb10dd1f9
- https://git.kernel.org/stable/c/543ed0f61d56501cc585162da600bbedd7c08c0f
- https://git.kernel.org/stable/c/cb6311f25a096621ac7ffd91b50d1bb1cfb63a96
- https://git.kernel.org/stable/c/85043dd49c2f51a37b22618168e3ae59ab92f0d6