Xiaogang Chen 2321831d7e drm/amdkfd: Use memdup_array_user to copy data from/to user space at kfd ioctls ...

Several kfd ioctls need transfer array data from/to user space. Kfd driver
uses kmalloc_array with user provided size. That can oversize alloc or 32-bit
wrap with hostile value. Replace it by memdup_array_user that does overflow
checking and allocates through dedicated slab caches, also physical continuous
as kmalloc.

Signed-off-by: Xiaogang Chen <xiaogang.chen@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 4eca4742eb215951f9739ffe0122d179d545a7a4)

2026-06-17 18:24:53 -04:00

..

adp

Merge tag 'drm-misc-next-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-08 14:16:04 +10:00

amd

drm/amdkfd: Use memdup_array_user to copy data from/to user space at kfd ioctls

2026-06-17 18:24:53 -04:00

arm

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

armada

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

aspeed

…

ast

Merge tag 'drm-misc-next-2026-04-20' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-06 10:12:25 +10:00

atmel-hlcdc

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

bridge

Merge drm/drm-next into drm-misc-next

2026-05-28 11:27:53 +02:00

ci

Merge tag 'drm-msm-next-2026-05-30' of https://gitlab.freedesktop.org/drm/msm into drm-next

2026-06-04 06:41:22 +10:00

clients

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

display

drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device

2026-05-27 16:36:58 +03:00

etnaviv

Merge v7.1-rc5 into drm-next

2026-05-28 09:58:36 +02:00

exynos

Merge v7.1-rc5 into drm-next

2026-05-28 09:58:36 +02:00

fsl-dcu

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

gma500

Merge v7.1-rc5 into drm-next

2026-05-28 09:58:36 +02:00

gud

drm/gud: Add RCade Display Adapter VID/PID pair

2026-05-12 08:35:00 +02:00

hisilicon

drm/hisilicon/kirin: switch to of_drm_get_bridge_by_endpoint()

2026-05-19 10:57:25 +02:00

hyperv

Merge tag 'drm-misc-next-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-08 14:16:04 +10:00

i915

Merge tag 'drm-intel-gt-next-2026-05-29' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next

2026-06-03 16:28:43 +10:00

imagination

drm/imagination: Fix missing argument in pvr_power_fw_{en,dis}able()

2026-05-20 10:52:10 +02:00

imx

Merge tag 'drm-misc-next-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-08 14:16:04 +10:00

ingenic

Merge tag 'drm-misc-next-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-08 14:16:04 +10:00

kmb

Merge tag 'drm-misc-next-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-08 14:16:04 +10:00

lima

drm/lima: Remove drm_sched_init_args->num_rqs usage

2026-04-17 14:43:29 +02:00

logicvc

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

loongson

Merge v7.1-rc5 into drm-next

2026-05-28 09:58:36 +02:00

mcde

drm/mcde: dsi: convert to of_drm_find_and_get_bridge()

2026-02-23 10:10:34 +01:00

mediatek

Merge v7.1-rc5 into drm-next

2026-05-28 09:58:36 +02:00

meson

Merge tag 'drm-misc-next-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-08 14:16:04 +10:00

mgag200

Merge tag 'drm-misc-next-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-08 14:16:04 +10:00

msm

Merge tag 'drm-msm-next-2026-05-30' of https://gitlab.freedesktop.org/drm/msm into drm-next

2026-06-04 06:41:22 +10:00

mxsfb

Merge tag 'drm-misc-next-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-08 14:16:04 +10:00

nouveau

Revert "nouveau/gsp: cleanup IS_ERR_OR_NULL in rm_alloc functions"

2026-05-28 22:49:53 +02:00

nova

rust/drm/gem: Use DeviceContext with GEM objects

2026-06-02 22:51:16 +02:00

omapdrm

Merge tag 'drm-misc-next-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-08 14:16:04 +10:00

panel

Merge drm/drm-next into drm-misc-next

2026-05-28 11:27:53 +02:00

panfrost

Merge v7.1-rc5 into drm-next

2026-05-28 09:58:36 +02:00

panthor

drm/panthor: Reduce padding in gems debugfs for refcount

2026-05-28 16:47:37 +02:00

pl111

BackMerge tag 'v6.19-rc7' into drm-next

2026-01-28 12:44:28 +10:00

qxl

Merge v7.1-rc5 into drm-next

2026-05-28 09:58:36 +02:00

radeon

drm/radeon: fix r100_copy_blit for large BOs

2026-06-17 18:19:00 -04:00

renesas

drm: renesas: rz-du: Add support for RZ/T2H SoC

2026-05-22 07:31:55 +01:00

rockchip

drm/rockchip: dw_hdmi: avoid direct dereference of phy->dev.of_node

2026-05-21 11:35:04 +02:00

scheduler

drm/sched: Fix clang build warning in kunit tests

2026-05-29 10:37:12 +01:00

sitronix

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

solomon

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

sprd

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

sti

Merge v7.1-rc5 into drm-next

2026-05-28 09:58:36 +02:00

stm

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

sun4i

drm/sun4i: hdmi: Use the common TMDS char rate constant

2026-05-21 11:45:53 +02:00

sysfb

Merge tag 'drm-misc-next-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-08 14:16:04 +10:00

tegra

drm/tegra: Fix iommu_map_sgtable() return value check

2026-05-28 17:19:30 +02:00

tests

Merge tag 'drm-misc-next-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-08 14:16:04 +10:00

tidss

Merge tag 'drm-misc-next-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-08 14:16:04 +10:00

tilcdc

Merge tag 'drm-misc-next-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-08 14:16:04 +10:00

tiny

Merge v7.1-rc5 into drm-next

2026-05-28 09:58:36 +02:00

ttm

drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure

2026-05-14 15:32:29 +02:00

tve200

drm/tve200: Fix probe cleanup after register failure

2026-05-05 11:16:39 +02:00

tyr

rust/drm/gem: Use DeviceContext with GEM objects

2026-06-02 22:51:16 +02:00

udl

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

v3d

drm/v3d: Clean caches before runtime suspend

2026-06-01 18:40:55 -03:00

vboxvideo

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

vc4

Merge tag 'drm-misc-next-2026-04-20' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-06 10:12:25 +10:00

verisilicon

drm: verisilicon: fix build failure of cursor plane code

2026-05-26 16:05:53 +08:00

vgem

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

virtio

drm/virtio: use uninterruptible resv lock for plane updates

2026-05-20 18:12:11 +03:00

vkms

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

vmwgfx

Merge tag 'drm-misc-next-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-08 14:16:04 +10:00

xe

Merge tag 'drm-misc-next-2026-05-28' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-06-03 15:47:53 +10:00

xen

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

xlnx

drm: zynqmp_dp: switch to of_drm_get_bridge_by_endpoint()

2026-05-19 10:57:26 +02:00

drm_atomic_helper.c

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

drm_atomic_state_helper.c

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

drm_atomic_uapi.c

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

drm_atomic.c

Merge tag 'drm-misc-next-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-08 14:16:04 +10:00

drm_auth.c

drm/auth: Only drm_drop_master if it exists

2026-04-21 22:05:51 +08:00

drm_blend.c

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

drm_bridge_helper.c

…

drm_bridge.c

drm/bridge: add of_drm_get_bridge_by_endpoint()

2026-05-19 10:57:25 +02:00

drm_buddy.c

drm/buddy: Integrate lockdep annotations for gpu buddy manager

2026-05-08 19:16:19 +05:30

drm_cache.c

…

drm_client_event.c

drm/client: Pass force parameter to client restore

2025-11-25 08:43:46 +01:00

drm_client_modeset.c

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

drm_client_sysrq.c

drm/client: Support emergency restore via sysrq for all clients

2025-11-25 08:43:47 +01:00

drm_client.c

drm/client: Export drm_client_buffer_create()

2026-03-03 09:28:31 +01:00

drm_color_mgmt.c

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

drm_colorop.c

drm/colorop: Check if getting curve_1d_type default succeeds

2026-04-17 03:11:21 +08:00

drm_connector.c

drm/connector: Make drm_connector_attach_hdr_output_metadata_property() return void

2026-04-10 10:59:09 -03:00

drm_crtc_helper_internal.h

…

drm_crtc_helper.c

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

drm_crtc_internal.h

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

drm_crtc.c

drm/simple-kms: Deprecate simple-kms helpers

2026-03-25 15:05:22 +01:00

drm_damage_helper.c

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

drm_debugfs_crc.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

drm_debugfs.c

drm/debug: don't register files for unsupported HDMI InfoFrames

2026-01-19 13:11:47 +02:00

drm_displayid_internal.h

drm/displayid: add quirk to ignore DisplayID checksum errors

2025-11-04 14:49:30 +02:00

drm_displayid.c

drm/displayid: add quirk to ignore DisplayID checksum errors

2025-11-04 14:49:30 +02:00

drm_draw_internal.h

drm/draw: add drm_draw_can_convert_from_xrgb8888

2025-12-19 23:06:41 +01:00

drm_draw.c

drm/draw: add drm_draw_can_convert_from_xrgb8888

2025-12-19 23:06:41 +01:00

drm_drv.c

drm/gem: Make the GEM LRU lock part of drm_device

2026-05-18 15:16:47 +02:00

drm_dumb_buffers.c

drm: include drm_print.h where needed

2025-10-31 10:34:52 +02:00

drm_edid_load.c

…

drm_edid.c

Revert "drm/edid: add CTA Video Format Data Block support"

2026-05-06 11:22:15 +02:00

drm_eld.c

…

drm_encoder.c

drm/encoder: drm_encoder_cleanup: lock the encoder chain mutex during removal

2026-04-16 09:08:42 +02:00

drm_exec.c

drm/exec, drm/xe: Avoid abusing the drm_exec retry pointer

2026-05-25 10:45:38 +02:00

drm_fb_dma_helper.c

…

drm_fb_helper.c

Merge v7.1-rc5 into drm-next

2026-05-28 09:58:36 +02:00

drm_fbdev_dma.c

drm/fb-helper: Allocate and release fb_info in single place

2025-11-25 11:02:43 +01:00

drm_fbdev_shmem.c

drm/fb-helper: Allocate and release fb_info in single place

2025-11-25 11:02:43 +01:00

drm_fbdev_ttm.c

drm/fb-helper: Allocate and release fb_info in single place

2025-11-25 11:02:43 +01:00

drm_file.c

Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug"

2026-03-26 14:09:26 +01:00

drm_flip_work.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

drm_format_helper.c

…

drm_format_internal.h

…

drm_fourcc.c

drm/fourcc: Add DRM_FORMAT_XVUY2101010

2026-05-05 14:04:29 +03:00

drm_framebuffer.c

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

drm_gem_atomic_helper.c

drm/simple-kms: Deprecate simple-kms helpers

2026-03-25 15:05:22 +01:00

drm_gem_dma_helper.c

drm/gem-dma: set VM_DONTDUMP for mmap

2026-03-26 14:35:18 +08:00

drm_gem_framebuffer_helper.c

drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()

2026-04-27 11:27:22 +02:00

drm_gem_shmem_helper.c

drm/gem/shmem: Introduce __drm_gem_shmem_free_sgt_locked()

2026-06-02 13:16:40 -04:00

drm_gem_ttm_helper.c

drm: include drm_print.h where needed

2025-10-31 10:34:52 +02:00

drm_gem_vram_helper.c

drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs

2026-04-09 09:34:28 +02:00

drm_gem.c

Merge v7.1-rc5 into drm-next

2026-05-28 09:58:36 +02:00

drm_gpusvm.c

drm: Drop HPAGE_PMD_SIZE dependency in dma_iova_try_alloc calls

2026-05-07 14:07:36 -04:00

drm_gpuvm.c

Merge tag 'drm-rust-next-2026-06-04' of https://gitlab.freedesktop.org/drm/rust/kernel into drm-next

2026-06-05 09:13:12 +10:00

drm_internal.h

drm/client: Support emergency restore via sysrq for all clients

2025-11-25 08:43:47 +01:00

drm_ioc32.c

drm/ioc32: stop speculation on the drm_compat_ioctl path

2026-04-02 08:24:55 +02:00

drm_ioctl.c

drm/colorop: Introduce DRM_CLIENT_CAP_PLANE_COLOR_PIPELINE

2025-11-26 23:03:32 +01:00

drm_kms_helper_common.c

…

drm_lease.c

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

drm_managed.c

…

drm_mipi_dbi.c

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

drm_mipi_dsi.c

drm/mipi-dsi: add mipi_dsi_shutdown_peripheral_multi

2026-04-24 10:12:16 -07:00

drm_mm.c

drm: include drm_print.h where needed

2025-10-31 10:34:52 +02:00

drm_mode_config.c

Merge v7.0-rc7 into drm-next

2026-04-07 12:36:31 +02:00

drm_mode_object.c

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

drm_modes.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

drm_modeset_helper.c

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

drm_modeset_lock.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

drm_of.c

drm: of: forbid bridge-only calls to drm_of_find_panel_or_bridge()

2026-05-19 10:57:26 +02:00

drm_pagemap_util.c

drm/pagemap_util: Ensure proper cache lock management on free

2026-03-17 15:39:07 +01:00

drm_pagemap.c

drm: Drop HPAGE_PMD_SIZE dependency in dma_iova_try_alloc calls

2026-05-07 14:07:36 -04:00

drm_panel_backlight_quirks.c

…

drm_panel_orientation_quirks.c

…

drm_panel.c

drm/panel: fix kernel-doc warning for devm_drm_panel_add()

2026-05-26 16:00:32 +02:00

drm_panic_qr.rs

…

drm_panic.c

drm/panic: Fix expected string for QR_CODE in drm_panic_type_map

2026-01-09 08:53:27 +00:00

drm_pci.c

…

drm_plane_helper.c

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

drm_plane.c

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

drm_prime.c

drm/prime: Limit scatter list size with dedicated DMA device

2026-03-23 13:23:29 +08:00

drm_print.c

…

drm_privacy_screen_x86.c

…

drm_privacy_screen.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

drm_probe_helper.c

drm/probe-helper: replace use of system_wq with system_percpu_wq

2026-02-09 09:41:09 +01:00

drm_property.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

drm_ras_genl_family.c

drm/ras: Introduce the DRM RAS infrastructure over generic netlink

2026-03-05 19:38:55 -05:00

drm_ras_nl.c

drm/drm_ras: Add clear-error-counter netlink command to drm_ras

2026-04-24 08:43:42 -04:00

drm_ras_nl.h

drm/drm_ras: Add clear-error-counter netlink command to drm_ras

2026-04-24 08:43:42 -04:00

drm_ras.c

drm/drm_ras: Add clear-error-counter netlink command to drm_ras

2026-04-24 08:43:42 -04:00

drm_rect.c

…

drm_self_refresh_helper.c

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

drm_simple_kms_helper.c

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

drm_suballoc.c

Merge tag 'drm-xe-next-2026-03-02' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next

2026-03-03 10:37:29 +10:00

drm_syncobj.c

drm/syncobj: Fix memory leak in drm_syncobj_find_fence()

2026-05-18 11:19:59 +01:00

drm_sysfs.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

drm_trace_points.c

…

drm_trace.h

…

drm_vblank_helper.c

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

drm_vblank_work.c

drm/vblank: use drm_crtc_vblank_crtc() in workers

2025-11-10 13:22:58 +02:00

drm_vblank.c

drm/vblank: Extract get_vblank_counter_and_timestamp()

2026-03-27 13:40:44 +02:00

drm_vma_manager.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

drm_writeback.c

dma-buf: inline spinlock for fence protection v5

2026-02-23 16:14:19 +01:00

Kconfig

drm/gpuvm: rust: add RUST_DRM_GPUVM option to Kconfig

2026-05-05 12:59:41 +02:00

Kconfig.debug

drm: fix dead default for DRM_TTM_KUNIT_TEST

2026-03-24 16:19:04 +01:00

Makefile

Merge drm/drm-next into drm-xe-next

2026-03-12 07:23:23 -07:00