From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ej1-f53.google.com (mail-ej1-f53.google.com [209.85.218.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C483A441635 for ; Thu, 30 Jul 2026 15:36:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.53 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785425778; cv=none; b=ho8LnY+7f8m8A75VCSUTagvJw+uzXSzBy/mZ6RwXNpZwPwrpzUfDKXN23Pp/syAy+PTZKEMD9j0p6HeY3S3kg1vopInADJL3n6zItnpkwVZZLpMgb7cPkDAiApYQEp64boP/Em3yN3afT4W1mWICJrxp5gyDSsTFnLjj9QR17Mo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785425778; c=relaxed/simple; bh=yPrD7Pg70d2Pt94om4tDPKj/88A4p2poijnU4vClxTw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=euSLRv5E+14vw/LUBtbhhZ0pNDPGNFkP7FV+LwQvpCdD+oZIDw2+hakjgjxg88Y7Oh8JVhpaerKyuGThU8sKrMWhQQJ7N8Hpx64gJz0z7H99Gc3r8BbCTxjY9YFmf/1oNf8JAp4SMh+4n1W0fQvrWp30rP9U6bJ9Ji6B4du3DNc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=H/5ZMb6o; arc=none smtp.client-ip=209.85.218.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="H/5ZMb6o" Received: by mail-ej1-f53.google.com with SMTP id a640c23a62f3a-c1671ec8692so287577266b.0 for ; Thu, 30 Jul 2026 08:36:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785425775; x=1786030575; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=p3SOhHIxVhGF41c8QPWamnwAmuGY/uvO36Ylk3s7hbw=; b=H/5ZMb6oMfXPSxEpx3lzZbmoWZTKU/3uYW8ORsybd5WJDO9QlsTLyF2gVzLnH9lYT9 h2ZEp4AASS8Ci0cI1++CIyBmeaxLwA8o/F5YRK5Txkiqy+StCHi1ORX8xVLk25j1oX/M f+n4I4kKB3jJfOC0Y4tmCYrqA3UqIPs1zla+SBd1HWKsEogFPLjMKRDI/63Tv9fBE61k Sl+H2134shcaR1SKqSLPWRx/mQrdZ5nhpeSg0WKEV+691UgE1YyYxMdVmdVqqflCxNFo 6B2N0XFSvEVRqTVcnFZizjmQSGFdyPpCoVtg2z/8D1K03NFhhUYrJ7iRPaqyO+c2YZSV 6LAA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785425775; x=1786030575; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=p3SOhHIxVhGF41c8QPWamnwAmuGY/uvO36Ylk3s7hbw=; b=TGZzSnTswaDCn2OzLsu+egP5K7QUAs4ZXYqumcA3mMKXHIfXQtOVbTBaW/oCDrmgaT xln0odp0sftWA2WAKzf280yCyveybyq/NuT3SdH2B0qGiig773qvT6/zuSpd/M7fK0rt 4YpeLbuTMv5MZaOTICQL6wPGascjkEhujs1G+jdaTq2UU9FpchEG5Yy4KWKpIDmLXM62 xtR8OjJBuq4FGWygnU/hqj+ne80sz7XNx9q7lgLdOClVF3KAFL+3U2tkk0dXxYGWC5Hg HWGS1Cc+NEqPpIhDScTmJ0bJqIeyaefR3vMgvNoPzYhCanJ8P8WMpI34ik9LohKv64hG maDg== X-Forwarded-Encrypted: i=1; AHgh+Rq/HT66g5GR1A8hdc4PR2CECr3618BTfFCcN3WBnS2/c4NjVy1oTQc2AmuToVDFJAl6znnOfLQAKpzjfQE=@vger.kernel.org X-Gm-Message-State: AOJu0YzjNYF3K4BF+6yIkSl2se3aXcnsq8B4oRSBzYF7FqA0iyyRoLwC 69tpI5X/quGUdeO4veHF10vUHUXtD/jSkvvrb8mYo/fjBcLgFusUBCAo X-Gm-Gg: AR+sD13j3ynTDz2Gu7FiKg3zyhfS9QSvcm0zF5fa1SgB2wQJWp6sXvGO5Rn/5U2DAye rFn6y0u4p2pgug3mX/OlcYpZXKHVsqnU/z+fS4i1LtLB8NdbjNL9t2XXCRcjW8MOBpXKOJjXnmO b5LJ+AQVf2VvlCXwdSR/PE77bXDGifZDUpzBy3zmY7ic55SgjudEv4yW9DsDw2VHSJieBrnpn6R iCRL+InSlXEqcwwoIJArSIqSafv9l6msrD5Dv9d1MuBG0pat+alj7FeliVNUBYQRnDBwYbzViP3 2Lhvqs/j4NRjEyz/ahHkqPI54izsI2rfVKOKmpISYwgdPDVXPTiERfQDxknKskbbooOBuojblAq tiKMqBcWT4mQUlVPNuHg8xY2/sw2H+hI5EvUCWIk8gc5qAVsDI3I3VtlyYnF8AneBFQgpaYl7U1 SPmrlP7KOLD2/SQNZ/Bp/7xgIAGMz/LV49JxXNLP1kk0WSzWeFib/7pIEomlOQusHGvDGDi4r+a 7k8GoPiFwxYjTmT01hwhLMXpzEfwf3RCPW7S6jbaJez2qh7eb/q X-Received: by 2002:a17:907:d10:b0:c12:959a:1477 with SMTP id a640c23a62f3a-c1fa57076cemr160900866b.40.1785425759630; Thu, 30 Jul 2026 08:35:59 -0700 (PDT) Received: from misharu.home (2a02-a463-a071-0-ee66-8497-94b5-6e78.fixed6.kpn.net. [2a02:a463:a071:0:ee66:8497:94b5:6e78]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c1fa8b762dasm84986366b.38.2026.07.30.08.35.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 30 Jul 2026 08:35:59 -0700 (PDT) From: Hari Mishal To: Felix Kuehling Cc: Alex Deucher , =?UTF-8?q?Christian=20K=C3=B6nig?= , David Airlie , Simona Vetter , amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Greg Kroah-Hartman , Hari Mishal Subject: [PATCH] drm/amdkfd: reject alloc_memory_of_gpu with wrapping va_addr/mmap_offset Date: Thu, 30 Jul 2026 17:35:55 +0200 Message-ID: <20260730153555.15176-1-harimishal1@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit kfd_ioctl_alloc_memory_of_gpu() computes the SVM overlap-check range as [va_addr, va_addr + size - 1] (and likewise for mmap_offset) and passes it to interval_tree_iter_first() with no check that the addition can overflow u64. With va_addr near U64_MAX, the end wraps below start, interval_tree_iter_first() sees an inverted range and returns NULL, and the overlap check is silently skipped. /dev/kfd is unprivileged, and va_addr/size/mmap_offset are plain fields in the ioctl argument struct supplied directly by the calling process, so this is reachable by any local user with a single crafted ioctl call. Reject the ioctl when either va_addr+size or mmap_offset+size overflows, using check_add_overflow(). Signed-off-by: Hari Mishal --- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c index 309510e23315..12954d65503c 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c @@ -1089,10 +1089,15 @@ static int kfd_ioctl_alloc_memory_of_gpu(struct file *filep, long err; uint64_t offset = args->mmap_offset; uint32_t flags = args->flags; + u64 end; if (args->size == 0) return -EINVAL; + if (check_add_overflow(args->va_addr, args->size, &end) || + check_add_overflow(args->mmap_offset, args->size, &end)) + return -EINVAL; + if (p->context_id != KFD_CONTEXT_ID_PRIMARY && (flags & KFD_IOC_ALLOC_MEM_FLAGS_USERPTR)) { pr_debug("USERPTR is not supported on non-primary kfd_process\n"); -- 2.43.0