github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-24 06:24:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

drm/amdgpu: bounds check atom indirect io method

Browse Source 
Bound indirect io method execution by the BIOS size to avoid
out-of-bounds reads.

Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
Lijo Lazar 2026-06-22 13:35:14 +05:30 committed by Alex Deucher
parent 1e453f7e77
commit 0b2becfc28
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/gpu/drm/amd/amdgpu/atom.c
View File

@ -114,8 +114,10 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
uint32_t index, uint32_t data)
{
uint32_t temp = 0xCDCDCDCD;
int start = base;
while (1)
/* IIO opcodes read up to base+3; keep within the BIOS image */
while (base + 3 < ctx->bios_size)
switch (CU8(base)) {
case ATOM_IIO_NOP:
base++;
@ -180,6 +182,9 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
pr_info("Unknown IIO opcode\n");
return 0;
}
pr_info("IIO method starting at offset %d runs past BIOS image\n", start);
return 0;
}
static uint32_t atom_get_src_int(atom_exec_context *ctx, uint8_t attr,