drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr
Impact
In the Linux kernel, the following vulnerability has been resolved:
Source excerpt · LinuxAffected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Linux · Linux
Other versions: unaffected
| Version / range | Source status |
|---|---|
| 9eee152aab56d374edb9ad21b3db05f5cdda2fe6 to before 652b1f26125fe48aed5f4944698a85b457eef491 | affected |
| 9eee152aab56d374edb9ad21b3db05f5cdda2fe6 to before 253555a9baccefffe1f6e5f2fe54363c7c01ebb9 | affected |
| 9eee152aab56d374edb9ad21b3db05f5cdda2fe6 to before de9f6bcdb44f0e410031002e2f103826ea6b6259 | affected |
| 865e2dbadf6856c9219626fbd6154cac44e5fbca | affected |
| 5.8.2 to before 5.9 | affected |
Linux · Linux
Other versions: affected
| Version / range | Source status |
|---|---|
| 5.9 | affected |
| 0 to before 5.9 | unaffected |
| 6.18.59 through 6.18.* (inclusive) | unaffected |
| 7.2.13 through 7.2.* (inclusive) | unaffected |
| 7.3 through * (inclusive) | unaffected |
Original source description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr
amdgpu_debugfs_gpr_read() drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which drops the reference a second time. A read into a bad buffer on Navi31 either steals a reference somebody else holds (power/runtime_usage goes from 1 to 0) or underflows the count:
amdgpu 0000:03:00.0: Runtime PM usage count underflow!
The registers are already in the kernel buffer at that point, so finish the hardware access first and copy the buffer with a single copy_to_user() instead of the put_user() loop with its own error path.
(cherry picked from commit 31035bbd74f7c3e10c163db875b8e67f8b50ee6a)