• File: sys/dev/drm/amd/amdgpu/amdgpu_gfx.c
• Lines: 98–100
• Severity: Info
• CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U:C:N/I:N/A:N
• CWE: CWE-758 Reliance on Undefined Behavior, CWE-770 Missing bounds check on shift operand
• Confidence: likely
• Status: new

Summary

amdgpu_gfx_scratch_free trusts its reg argument and computes 1u << (reg - reg_base) with no validation. If any caller ever passes a reg outside [reg_base, reg_base + scratch.num_reg), the shift amount is >= 32 (UB) or, if reg < reg_base, wraps to a huge unsigned value, corrupting free_mask or yielding UB.

All current callers round-trip the reg through amdgpu_gfx_scratch_get (which guarantees reg - reg_base in [0, num_reg-1] = [0,7]), so this is a latent hardening gap, not a live bug.

Root cause

amdgpu_gfx.c:100: adev->gfx.scratch.free_mask |= 1u << (reg - adev->gfx.scratch.reg_base); has no if (reg - reg_base < scratch.num_reg) guard, unlike amdgpu_gfx_scratch_get at lines 80-86 which bounds i via i <= num_reg.

scratch.num_reg is 8 on every ASIC (gfx_v7_0.c:2042, gfx_v8_0.c:828, gfx_v9_0.c:351).

All current callers (gfx_v7_0.c:2075/2096/2362, gfx_v8_0.c:851/873, gfx_v9_0.c:408/430) pass the exact value obtained from amdgpu_gfx_scratch_get, so the difference is always in [0,7] and the shift is safe today.

Threat model

No reachable misuse. The function is an internal helper called only from gfx_v{7,8,9}_0.c scratch-register probe/teardown sequences with values obtained from the matching scratch_get.

Not exposed to unprivileged users, sysfs, or ioctls. Defense-in-depth only.

Recommended fix

Add a bounds guard mirroring scratch_get, returning early (or WARN_ONCE) if reg is out of range:

--- a/sys/dev/drm/amd/amdgpu/amdgpu_gfx.c
+++ b/sys/dev/drm/amd/amdgpu/amdgpu_gfx.c
@@ -98,6 +98,10 @@ int amdgpu_gfx_scratch_get(struct amdgpu_device *adev, uint32_t *reg)
 void amdgpu_gfx_scratch_free(struct amdgpu_device *adev, uint32_t reg)
 {
+   uint32_t i = reg - adev->gfx.scratch.reg_base;
+
+   if (i >= adev->gfx.scratch.num_reg)
+       return;
    adev->gfx.scratch.free_mask |= 1u << i;
 }

References

• sys/dev/drm/amd/amdgpu/amdgpu_gfx.c:98-100 — unbounded shift in scratch_free
• sys/dev/drm/amd/amdgpu/amdgpu_gfx.c:80-86 — scratch_get correctly bounds i via i <= num_reg