In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Validate CRIU-restored IDs before idr_alloc
The KFD CRIU restore flow restores previously saved object IDs from userspace.
For event restore:
kfd_criu_restore_event() -> create_signal_event() / create_other_event() -> allocate_event_notification_slot() -> idr_alloc(..., *restore_id, *restore_id + 1, ...)
For BO restore:
criu_restore_memory_of_gpu() -> idr_alloc(..., bo_priv->idr_handle, ...)
In both cases, the restored ID comes from userspace-provided CRIU data.
idr_alloc() expects the ID range values to fit within signed int limits. If a restored ID is larger than INT_MAX, it can trigger a WARN in the IDR layer.
A kernel WARN is undesirable because it prints a warning trace and may cause a panic or reboot on systems with panic_on_warn enabled.
Smatch reported these paths as allowing unchecked userspace values to reach idr_alloc().
Add INT_MAX validation before using restored IDs in:
If the restored ID is invalid, return -EINVAL.
This prevents invalid restore data from reaching the IDR layer and avoids WARN-triggering paths, while keeping valid restore behavior unchanged.