Vladimir Marioukhine 6aa530642f drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore ... Both create_queue_cpsch() and create_queue_nocpsch() unconditionally call mqd_mgr->restore_mqd() when a CRIU restore is in progress (qd != NULL), with no NULL guard. On any system where restore_mqd is not implemented for the given queue type, a user holding CAP_CHECKPOINT_RESTORE can trigger a kernel NULL pointer dereference and panic the machine by issuing KFD_IOC_CRIU_OP_RESTORE with a crafted queue restore object. Note that checkpoint_mqd is likewise unimplemented on GFX12, so no legitimate CRIU image can reach this path — only a hand-crafted restore payload. Add a NULL guard for restore_mqd immediately after mqd_mgr is resolved, unwinding via the existing error labels and returning -EOPNOTSUPP if the callback is not implemented. This mirrors the existing checkpoint_mqd guard in checkpoint_mqd(). Fixes: 48f0bdf4e3 ("drm/amdkfd: Added MQD manager files for GFX12.") Cc: stable@vger.kernel.org Signed-off-by: Vladimir Marioukhine <Vladimir.Marioukhine@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>		2026-08-25 18:22:22 -04:00
..
cik_event_interrupt.c	drm/amdkfd: Don't expect signal mailbox update	2026-03-17 10:31:39 -04:00
cik_int.h
cik_regs.h
cwsr_trap_handler_gfx8.asm
cwsr_trap_handler_gfx9.asm
cwsr_trap_handler_gfx10.asm
cwsr_trap_handler_gfx12.asm	drm/amdkfd: fix CWSR trap handler	2026-02-26 11:20:10 -05:00
cwsr_trap_handler.h	drm/amdkfd: gfx12.1 trap handler instruction fixup for VOP3PX	2026-01-28 16:21:21 -05:00
Kconfig	dma-buf: Always build with DMABUF_MOVE_NOTIFY	2026-01-27 10:45:11 +01:00
kfd_chardev.c	drm/amdkfd: Reject zero-sized AQL queue allocations after size halving	2026-08-25 18:18:44 -04:00
kfd_crat.c	drm/amdkfd: Add bounds check for CRAT subtype length	2026-07-16 18:27:26 -04:00
kfd_crat.h
kfd_debug.c	drm/amdkfd: Unwind debug trap enable on copy_to_user failure	2026-06-04 15:25:55 -04:00
kfd_debug.h
kfd_debugfs.c	drm/amdkfd: Do not fail process debugfs setup on debugfs errors	2026-07-15 09:15:10 -04:00
kfd_device_queue_manager_cik.c
kfd_device_queue_manager_v9.c
kfd_device_queue_manager_v10.c
kfd_device_queue_manager_v11.c
kfd_device_queue_manager_v12_1.c	drm/amdkfd: Limit per-process xnack support for GFX12.1	2026-04-24 10:57:31 -04:00
kfd_device_queue_manager_v12.c
kfd_device_queue_manager_vi.c
kfd_device_queue_manager.c	drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore	2026-08-25 18:22:22 -04:00
kfd_device_queue_manager.h	drm/amdkfd: Check bounds on CRIU restore queue type and mqd size	2026-07-08 14:21:51 -04:00
kfd_device.c	drm/amdgpu: add support for GC IP version 11.7.1	2026-07-01 13:01:48 -04:00
kfd_doorbell.c	drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap	2026-06-17 18:24:47 -04:00
kfd_events.c	drm/amdkfd: Fix signal reset event	2026-07-28 19:17:33 -04:00
kfd_events.h	drm/amdkfd: drop struct kfd_signal_page wrapper	2026-07-01 11:14:53 -04:00
kfd_flat_memory.c	drm/amdgpu: GFX12.1 scratch memory limit up to 57-bit	2026-03-04 11:42:26 -05:00
kfd_int_process_v9.c	drm/amdkfd: Don't expect signal mailbox update	2026-03-17 10:31:39 -04:00
kfd_int_process_v10.c	drm/amdkfd: Don't expect signal mailbox update	2026-03-17 10:31:39 -04:00
kfd_int_process_v11.c	drm/amdkfd: Don't expect signal mailbox update	2026-03-17 10:31:39 -04:00
kfd_int_process_v12_1.c	drm/amdkfd: Switch to dev_* printk stuff in kfd_int_process_v12_1.c	2026-03-30 15:13:14 -04:00
kfd_interrupt.c
kfd_kernel_queue.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
kfd_kernel_queue.h
kfd_migrate.c	drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram	2026-08-25 18:22:00 -04:00
kfd_migrate.h
kfd_module.c
kfd_mqd_manager_cik.c	drm/amdkfd: Removed commented line for MQD queue priority	2026-02-25 16:28:10 -05:00
kfd_mqd_manager_v9.c	drm/amdkfd: preserve VRAM MQD across hibernation via unpin/repin	2026-08-12 09:37:44 -04:00
kfd_mqd_manager_v10.c	drm/amdkfd: Guard m->cp_hqd_eop_control setting by q->eop_ring_buffer_size	2026-07-01 12:58:33 -04:00
kfd_mqd_manager_v11.c	drm/amdkfd: Guard m->cp_hqd_eop_control setting by q->eop_ring_buffer_size	2026-07-01 12:58:33 -04:00
kfd_mqd_manager_v12_1.c	drm/amdkfd: Guard m->cp_hqd_eop_control setting by q->eop_ring_buffer_size	2026-07-01 12:58:33 -04:00
kfd_mqd_manager_v12.c	drm/amdkfd: Guard m->cp_hqd_eop_control setting by q->eop_ring_buffer_size	2026-07-01 12:58:33 -04:00
kfd_mqd_manager_vi.c	drm/amdkfd: Guard m->cp_hqd_eop_control setting by q->eop_ring_buffer_size	2026-07-01 12:58:33 -04:00
kfd_mqd_manager.c	drm/amdkfd: Extend MQDs in HBM to gfx944	2026-06-17 16:07:56 -04:00
kfd_mqd_manager.h	drm/amdkfd: preserve VRAM MQD across hibernation via unpin/repin	2026-08-12 09:37:44 -04:00
kfd_packet_manager_v9.c	drm/amdkfd: allow CWSR grace period of 0 on supported firmware	2026-07-28 19:17:33 -04:00
kfd_packet_manager_vi.c
kfd_packet_manager.c	drm/amdkfd: Clean up debug runlist printing	2026-07-16 18:26:59 -04:00
kfd_pm4_headers_ai.h
kfd_pm4_headers_aldebaran.h
kfd_pm4_headers_vi.h
kfd_pm4_headers.h
kfd_pm4_opcodes.h
kfd_priv.h	drm/amdkfd: preserve VRAM MQD across hibernation via unpin/repin	2026-08-12 09:37:44 -04:00
kfd_process_queue_manager.c	drm/amdkfd: enable rs64mem for kfd queue	2026-08-06 12:46:14 -04:00
kfd_process.c	drm/amdkfd: enable rs64mem for kfd queue	2026-08-06 12:46:14 -04:00
kfd_queue.c	drm/amdgpu: Fix typo in comment	2026-08-06 13:47:02 -04:00
kfd_smi_events.c	drm/amdkfd: use scnprintf/vscnprintf in kfd_smi_event_add	2026-07-01 11:16:48 -04:00
kfd_smi_events.h	drm/amdkfd: Fix SMI event PID reporting for containers	2026-06-17 18:12:00 -04:00
kfd_svm.c	drm/amdkfd: Unmap svm range from GPU set to no-access	2026-08-06 09:25:49 -04:00
kfd_svm.h	drm/amdkfd: Unmap svm range from GPU set to no-access	2026-08-06 09:25:49 -04:00
kfd_topology.c	drm/amdkfd: Add gfx12.0 queue reset support to topology	2026-07-01 11:23:26 -04:00
kfd_topology.h
Makefile
soc15_int.h