RE: [PATCH] drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment

AMD General

Reviewed-by: Alysa Liu <[email protected]>

-----Original Message-----
From: Palacek, William <[email protected]>
Sent: Wednesday, July 22, 2026 10:12 AM
To: [email protected]
Cc: Palacek, William <[email protected]>; Kasiviswanathan, Harish <[email protected]>; Liu, Alysa <[email protected]>; Russell, Kent <[email protected]>
Subject: [PATCH] drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment

eop_ring_buffer_size in struct queue_properties is a u32. In
kfd_queue_acquire_buffers() the expected EOP buffer size is computed as ALIGN(eop_ring_buffer_size, PAGE_SIZE); ALIGN uses typeof(x), so the addition is done in 32-bit. A user-supplied size of 0xFFFFF001 wraps to 0, causing kfd_queue_buffer_get() to skip its exact-size check (gated on size != 0) and accept any BO mapped at the address. On GFX8/GFX9 the MQD cp_hqd_eop_control is then programmed for an 8KB EOP ring backed by a 4KB BO, so CP EOP writes can land past the buffer and fault the GPU.

Cast the operand to u64 so the alignment is computed in 64-bit; the size check in kfd_queue_buffer_get() then rejects the oversized request.

Fixes: 42ea9cf2f16b ("drm/amdkfd: Relax size checking during queue buffer get")
Signed-off-by: William Palacek <[email protected]>
---
 drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
index 98a5512b701b..b249e7d1af48 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
@@ -288,7 +288,7 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope
                }
                err = kfd_queue_buffer_get(vm, (void *)properties->eop_ring_buffer_address,
                                           &properties->eop_buf_bo,
-                                          ALIGN(properties->eop_ring_buffer_size, PAGE_SIZE));
+                                          ALIGN((u64)properties->eop_ring_buffer_size, PAGE_SIZE));
                if (err)
                        goto out_err_unreserve;
        }
--
2.34.1