Re: [PATCH 1/2] drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore

Series is:
Reviewed-by: Alex Deucher <[email protected]>

On Thu, Aug 13, 2026 at 1:15 PM Marioukhine, Vladimir
<[email protected]> wrote:
>
> AMD General
>
>
> Both create_queue_cpsch() and create_queue_nocpsch() unconditionally
>
> call mqd_mgr->restore_mqd() when a CRIU restore is in progress
>
> (qd != NULL), with no NULL guard. On any system where restore_mqd is
>
> not implemented, a user holding CAP_CHECKPOINT_RESTORE can trigger a
>
> kernel NULL pointer dereference and panic the machine by issuing
>
> KFD_IOC_CRIU_OP_RESTORE with a crafted queue restore object.
>
>
>
> Add a NULL guard for restore_mqd right after mqd_mgr is resolved,
>
> before any resource allocations, returning -EOPNOTSUPP if the callback
>
> is not implemented. This avoids complex error unwinding and is
>
> consistent with the existing checkpoint_mqd guard.
>
>
>
> Fixes: 48f0bdf4e38e ("drm/amdkfd: Added MQD manager files for GFX12.")
>
> Fixes: 01bbc4a4b947 ("drm/amdkfd: Add MQD manager for GFX 12.1.0")
>
> Cc: [email protected]
>
> Signed-off-by: Vladimir Marioukhine <[email protected]>
>
> ---
>
> drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 10 ++++++++++
>
> 1 file changed, 10 insertions(+)
>
>
>
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
>
> index ea9d87450eae..25b738200e7e 100644
>
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
>
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
>
> @@ -769,6 +769,11 @@ static int create_queue_nocpsch(struct device_queue_manager *dqm,
>
>                mqd_mgr = dqm->mqd_mgrs[get_mqd_type_from_queue_type(
>
>                                             q->properties.type)];
>
> +            if (qd && !mqd_mgr->restore_mqd) {
>
> +                           pr_debug("restore_mqd not implemented for this GPU\n");
>
> +                           retval = -EOPNOTSUPP;
>
> +                           goto deallocate_vmid;
>
> +            }
>
>               if (q->properties.type == KFD_QUEUE_TYPE_COMPUTE) {
>
>                              retval = allocate_hqd(dqm, q);
>
>                              if (retval)
>
> @@ -2134,6 +2139,11 @@ static int create_queue_cpsch(struct device_queue_manager *dqm, struct queue *q,
>
>                mqd_mgr = dqm->mqd_mgrs[get_mqd_type_from_queue_type(
>
>                                             q->properties.type)];
>
> +            if (qd && !mqd_mgr->restore_mqd) {
>
> +                           pr_debug("restore_mqd not implemented for this GPU\n");
>
> +                           retval = -EOPNOTSUPP;
>
> +                           goto out_deallocate_sdma_queue;
>
> +            }
>
>                if (q->properties.type == KFD_QUEUE_TYPE_SDMA ||
>
>                              q->properties.type == KFD_QUEUE_TYPE_SDMA_XGMI)
>
>