Kernel memory exposure via command-size integer overflow

Integer overflow in the Linux kernel allows local users to expose kernel memory or crash the host through the AMDGPU command-submit ioctl. amdgpu_cs_pass1 stores an attacker-controlled chunk length in an unsigned int, so multiplying 0x40000000 by four wraps the allocation size to zero and leaves later parser data uninitialized. Access requires a local AMDGPU render or card device node; the resulting stale kernel data use supports disclosure, memory corruption, allocation pressure, and kernel crashes.