Re: [PATCH] drm/amdgpu: Fix out-of-bounds write in amdgpu_debugfs_gfxoff_count_read()

[Christian König]

On 10/15/26 04:20, ya...@kylinos.cn wrote:
> From: Lu Yao <ya...@kylinos.cn>
> 
> amdgpu_debugfs_gfxoff_count_read() stores a 64-bit GFXOFF entry count with
> put_user(), but advances buf/pos/size by 4 bytes per iteration.
> 
> Fixes: 0ad7347a64ac ("drm/amd: Add detailed GFXOFF stats to debugfs")
> Signed-off-by: Lu Yao <ya...@kylinos.cn>
> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c 
> b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
> index ab7ccfaea22a..aa44a3f0cdc4 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
> @@ -1451,7 +1451,7 @@ static ssize_t amdgpu_debugfs_gfxoff_count_read(struct 
> file *f, char __user *buf
>       ssize_t result = 0;
>       int r;
>  
> -     if (size & 0x3 || *pos & 0x3)
> +     if (size & 0x7 || *pos & 0x7)
>               return -EINVAL;
>  
>       r = pm_runtime_get_sync(adev_to_drm(adev)->dev);
> @@ -1471,10 +1471,10 @@ static ssize_t 
> amdgpu_debugfs_gfxoff_count_read(struct file *f, char __user *buf
>               if (r)
>                       goto out;
>  
> -             result += 4;
> -             buf += 4;
> -             *pos += 4;
> -             size -= 4;
> +             result += 8;
> +             buf += 8;
> +             *pos += 8;
> +             size -= 8;

That's a good catch, but the code is a bit questionable to begin with.

Why are we reading the value multiple times and in binary instead of text?

The same is true for the other amdgpu_debugfs_gfxoff_* functions.

Regards,
Christian.

>       }
>  
>       r = result;