Re: [PATCH] drm/amdgpu: Fix out-of-bounds write in amdgpu_debugfs_gfxoff_count_read()

[Christian König]

On 10/15/26 04:20, yaolu@xxxxxxxxxx wrote:
> From: Lu Yao <yaolu@xxxxxxxxxx>
> 
> amdgpu_debugfs_gfxoff_count_read() stores a 64-bit GFXOFF entry count with
> put_user(), but advances buf/pos/size by 4 bytes per iteration.
> 
> Fixes: 0ad7347a64ac ("drm/amd: Add detailed GFXOFF stats to debugfs")
> Signed-off-by: Lu Yao <yaolu@xxxxxxxxxx>
> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
> index ab7ccfaea22a..aa44a3f0cdc4 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
> @@ -1451,7 +1451,7 @@ static ssize_t amdgpu_debugfs_gfxoff_count_read(struct file *f, char __user *buf
>  	ssize_t result = 0;
>  	int r;
>  
> -	if (size & 0x3 || *pos & 0x3)
> +	if (size & 0x7 || *pos & 0x7)
>  		return -EINVAL;
>  
>  	r = pm_runtime_get_sync(adev_to_drm(adev)->dev);
> @@ -1471,10 +1471,10 @@ static ssize_t amdgpu_debugfs_gfxoff_count_read(struct file *f, char __user *buf
>  		if (r)
>  			goto out;
>  
> -		result += 4;
> -		buf += 4;
> -		*pos += 4;
> -		size -= 4;
> +		result += 8;
> +		buf += 8;
> +		*pos += 8;
> +		size -= 8;

That's a good catch, but the code is a bit questionable to begin with.

Why are we reading the value multiple times and in binary instead of text?

The same is true for the other amdgpu_debugfs_gfxoff_* functions.

Regards,
Christian.

>  	}
>  
>  	r = result;