From: Vitaly Prosyak Date: Fri, 24 Apr 2026 02:30:48 +0000 (-0400) Subject: drm/amd/pm: Reject negative values in thermal_throttling_logging X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=220e2e3b9634f21633993b14b340be1c54387a4d;p=thirdparty%2Flinux.git drm/amd/pm: Reject negative values in thermal_throttling_logging Discovery: Fuzzing for secure supply chain requirements Tool: amd_fuzzing_sysfs (IGT test) The thermal_throttling_logging sysfs store function accepts negative values like -1 and -9999999, which are nonsensical for a logging interval. Current behavior: - Values <= 0 disable logging (intended for 0 only) - Values 1-3600 enable logging with interval in seconds - Negative values are accepted and treated as disable Issue: Large negative values like -9999999 make no semantic sense and could indicate input validation bypass attempts. While they functionally disable logging (same as 0), accepting arbitrary negative values suggests inadequate input validation. Fix: Add explicit check to reject values < 0 before processing. Only accept: - 0: disable thermal throttling logging - 1-3600: enable with interval in seconds (existing validation) This improves input validation and makes the interface more robust. Test Results Before Fix: thermal_throttling_logging: 6 failures - Accepted: 0, -1, -9999999, -2147483648, empty string, 0777 Test Results After Fix: thermal_throttling_logging: 3 failures - Rejected: -1, -9999999, -2147483648 (now return -EINVAL) - Remaining: empty string (VFS behavior), 0 (valid), 0777 (octal) Tested: amd_fuzzing_sysfs IGT test Cc: Christian König Cc: Alex Deucher Cc: Jesse Zhang Signed-off-by: Vitaly Prosyak Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher --- diff --git a/drivers/gpu/drm/amd/pm/amdgpu_pm.c b/drivers/gpu/drm/amd/pm/amdgpu_pm.c index a0250431ad112..ffb03c51a4142 100644 --- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c +++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c @@ -1634,6 +1634,10 @@ static ssize_t amdgpu_set_thermal_throttling_logging(struct device *dev, if (ret) return ret; + /* Reject negative values - only 0 (disable) or 1-3600 (seconds) are valid */ + if (throttling_logging_interval < 0) + return -EINVAL; + if (throttling_logging_interval > 3600) return -EINVAL;