CVE-2026-45878: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2

CVE-2026-45878: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix watch_id bounds checking in debug address watch v2

The address watch clear code receives watch_id as an unsigned value
(u32), but some helper functions were using a signed int and checked
bits by shifting with watch_id.

If a very large watch_id is passed from userspace, it can be converted
to a negative value.  This can cause invalid shifts and may access
memory outside the watch_points array.

drm/amdkfd: Fix watch_id bounds checking in debug address watch v2

Fix this by checking that watch_id is within MAX_WATCH_ADDRESSES before
using it.  Also use BIT(watch_id) to test and clear bits safely.

This keeps the behavior unchanged for valid watch IDs and avoids
undefined behavior for invalid ones.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c:448
kfd_dbg_trap_clear_dev_address_watch() error: buffer overflow
'pdd->watch_points' 4 <= u32max user_rl='0-3,2147483648-u32max' uncapped

drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c
    433 int kfd_dbg_trap_clear_dev_address_watch(struct kfd_process_device *pdd,
    434                                         uint32_t watch_id)
    435 {
    436         int r;
    437
    438         if (!kfd_dbg_owns_dev_watch_id(pdd, watch_id))

kfd_dbg_owns_dev_watch_id() doesn't check for negative values so if
watch_id is larger than INT_MAX it leads to a buffer overflow.
(Negative shifts are undefined).

    439                 return -EINVAL;
    440
    441         if (!pdd->dev->kfd->shared_resources.enable_mes) {
    442                 r = debug_lock_and_unmap(pdd->dev->dqm);
    443                 if (r)
    444                         return r;
    445         }
    446
    447         amdgpu_gfx_off_ctrl(pdd->dev->adev, false);
--> 448         pdd->watch_points[watch_id] = pdd->dev->kfd2kgd->clear_address_watch(
    449                                                         pdd->dev->adev,
    450                                                         watch_id);

v2: (as per, Jonathan Kim)
 - Add early watch_id >= MAX_WATCH_ADDRESSES validation in the set path to
   match the clear path.
 - Drop the redundant bounds check in kfd_dbg_owns_dev_watch_id().

The Linux kernel CVE team has assigned CVE-2026-45878 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.5 with commit e0f85f4690d089cc1a60337decafb1acf7eec45e and fixed in 6.6.128 with commit 971bf8e61e9b4abaacf9b35eaf76ec222758f9d6
	Issue introduced in 6.5 with commit e0f85f4690d089cc1a60337decafb1acf7eec45e and fixed in 6.12.75 with commit a0d367e13db63a6ed76ee0d0a8c3a58c1fa98488
	Issue introduced in 6.5 with commit e0f85f4690d089cc1a60337decafb1acf7eec45e and fixed in 6.18.14 with commit 2b36c0c1bcbbe15f6cfa9652084b3124c835a150
	Issue introduced in 6.5 with commit e0f85f4690d089cc1a60337decafb1acf7eec45e and fixed in 6.19.4 with commit 3c38a0f07aa2bfef2b219b1f045534ad93f85afd
	Issue introduced in 6.5 with commit e0f85f4690d089cc1a60337decafb1acf7eec45e and fixed in 7.0 with commit 5a19302cab5cec7ae7f1a60c619951e6c17d8742

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-45878
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/amd/amdkfd/kfd_debug.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/971bf8e61e9b4abaacf9b35eaf76ec222758f9d6
	https://git.kernel.org/stable/c/a0d367e13db63a6ed76ee0d0a8c3a58c1fa98488
	https://git.kernel.org/stable/c/2b36c0c1bcbbe15f6cfa9652084b3124c835a150
	https://git.kernel.org/stable/c/3c38a0f07aa2bfef2b219b1f045534ad93f85afd
	https://git.kernel.org/stable/c/5a19302cab5cec7ae7f1a60c619951e6c17d8742