In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/amdkfd: Validate CRIU-restored IDs before idr_alloc<\/p>\n
The KFD CRIU restore flow restores previously saved object IDs from
\nuserspace.<\/p>\n
For event restore:<\/p>\n
kfd_criu_restore_event()
\n -> create_signal_event() \/ create_other_event()
\n -> allocate_event_notification_slot()
\n -> idr_alloc(…, *restore_id, *restore_id + 1, …)<\/p>\n
For BO restore:<\/p>\n
criu_restore_memory_of_gpu()
\n -> idr_alloc(…, bo_priv->idr_handle, …)<\/p>\n
In both cases, the restored ID comes from userspace-provided CRIU data.<\/p>\n
idr_alloc() expects the ID range values to fit within signed int
\nlimits. If a restored ID is larger than INT_MAX, it can trigger a WARN
\nin the IDR layer.<\/p>\n
A kernel WARN is undesirable because it prints a warning trace and may
\ncause a panic or reboot on systems with panic_on_warn enabled.<\/p>\n
Smatch reported these paths as allowing unchecked userspace values to
\nreach idr_alloc().<\/p>\n
Add INT_MAX validation before using restored IDs in:<\/p>\n
– kfd_criu_restore_event()
\n– criu_restore_memory_of_gpu()<\/p>\n
If the restored ID is invalid, return -EINVAL.<\/p>\n
This prevents invalid restore data from reaching the IDR layer and
\navoids WARN-triggering paths, while keeping valid restore behavior
\nunchanged.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/amdkfd: Validate CRIU-restored IDs before idr_alloc<\/p>\n
The KFD CRIU restore flow restores previously saved object IDs from
\nusersp<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17418","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17418","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17418"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17418"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17418"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}