[PATCH] drm/amdgpu: Fix out-of-bounds write in amdgpu_debugfs_gfxoff_count_read()

[PATCH] drm/amdgpu: Fix out-of-bounds write in amdgpu_debugfs_gfxoff_count_read()

[yaolu]

From: Lu Yao <yaolu@kylinos.cn>

amdgpu_debugfs_gfxoff_count_read() stores a 64-bit GFXOFF entry count with
put_user(), but advances buf/pos/size by 4 bytes per iteration.

Fixes: 0ad7347a64ac ("drm/amd: Add detailed GFXOFF stats to debugfs")
Signed-off-by: Lu Yao <yaolu@kylinos.cn>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
index ab7ccfaea22a..aa44a3f0cdc4 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
@@ -1451,7 +1451,7 @@ static ssize_t amdgpu_debugfs_gfxoff_count_read(struct file *f, char __user *buf
 	ssize_t result = 0;
 	int r;
 
-	if (size & 0x3 || *pos & 0x3)
+	if (size & 0x7 || *pos & 0x7)
 		return -EINVAL;
 
 	r = pm_runtime_get_sync(adev_to_drm(adev)->dev);
@@ -1471,10 +1471,10 @@ static ssize_t amdgpu_debugfs_gfxoff_count_read(struct file *f, char __user *buf
 		if (r)
 			goto out;
 
-		result += 4;
-		buf += 4;
-		*pos += 4;
-		size -= 4;
+		result += 8;
+		buf += 8;
+		*pos += 8;
+		size -= 8;
 	}
 
 	r = result;
-- 
2.25.1

Re: [PATCH] drm/amdgpu: Fix out-of-bounds write in amdgpu_debugfs_gfxoff_count_read()

[Christian König]

On 10/15/26 04:20, yaolu@kylinos.cn wrote:
> From: Lu Yao <yaolu@kylinos.cn>
> 
> amdgpu_debugfs_gfxoff_count_read() stores a 64-bit GFXOFF entry count with
> put_user(), but advances buf/pos/size by 4 bytes per iteration.
> 
> Fixes: 0ad7347a64ac ("drm/amd: Add detailed GFXOFF stats to debugfs")
> Signed-off-by: Lu Yao <yaolu@kylinos.cn>
> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
> index ab7ccfaea22a..aa44a3f0cdc4 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
> @@ -1451,7 +1451,7 @@ static ssize_t amdgpu_debugfs_gfxoff_count_read(struct file *f, char __user *buf
>  	ssize_t result = 0;
>  	int r;
>  
> -	if (size & 0x3 || *pos & 0x3)
> +	if (size & 0x7 || *pos & 0x7)
>  		return -EINVAL;
>  
>  	r = pm_runtime_get_sync(adev_to_drm(adev)->dev);
> @@ -1471,10 +1471,10 @@ static ssize_t amdgpu_debugfs_gfxoff_count_read(struct file *f, char __user *buf
>  		if (r)
>  			goto out;
>  
> -		result += 4;
> -		buf += 4;
> -		*pos += 4;
> -		size -= 4;
> +		result += 8;
> +		buf += 8;
> +		*pos += 8;
> +		size -= 8;

That's a good catch, but the code is a bit questionable to begin with.

Why are we reading the value multiple times and in binary instead of text?

The same is true for the other amdgpu_debugfs_gfxoff_* functions.

Regards,
Christian.

>  	}
>  
>  	r = result;