CVE-2026-99150: drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr

CVE-2026-99150: drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr

amdgpu_debugfs_gpr_read() drops its runtime PM reference right after
reading the wave registers. When copying them to userspace fails, it
jumps to the err label, which drops the reference a second time. A read
into a bad buffer on Navi31 either steals a reference somebody else
holds (power/runtime_usage goes from 1 to 0) or underflows the count:

  amdgpu 0000:03:00.0: Runtime PM usage count underflow!

The registers are already in the kernel buffer at that point, so finish
the hardware access first and copy the buffer with a single
copy_to_user() instead of the put_user() loop with its own error path.

(cherry picked from commit 31035bbd74f7c3e10c163db875b8e67f8b50ee6a)

The Linux kernel CVE team has assigned CVE-2026-99150 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.9 with commit 9eee152aab56d374edb9ad21b3db05f5cdda2fe6 and fixed in 6.18.59 with commit 652b1f26125fe48aed5f4944698a85b457eef491
	Issue introduced in 5.9 with commit 9eee152aab56d374edb9ad21b3db05f5cdda2fe6 and fixed in 7.2.13 with commit 253555a9baccefffe1f6e5f2fe54363c7c01ebb9
	Issue introduced in 5.9 with commit 9eee152aab56d374edb9ad21b3db05f5cdda2fe6 and fixed in 7.3 with commit de9f6bcdb44f0e410031002e2f103826ea6b6259
	Issue introduced in 5.8.2 with commit 865e2dbadf6856c9219626fbd6154cac44e5fbca

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-99150
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/652b1f26125fe48aed5f4944698a85b457eef491
	https://git.kernel.org/stable/c/253555a9baccefffe1f6e5f2fe54363c7c01ebb9
	https://git.kernel.org/stable/c/de9f6bcdb44f0e410031002e2f103826ea6b6259