github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 01:55:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

drm/amdgpu: cap ATOM command table nesting depth

Browse Source 
Cap nesting at 32 levels with execute_depth and
return -ELOOP when exceeded.

Signed-off-by: Candice Li <candice.li@amd.com>
Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
Candice Li 2026-05-13 11:11:15 +08:00 committed by Alex Deucher
parent 3c88fb7aa5
commit 27ef1795bc
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/gpu/drm/amd/amdgpu/atom.c
View File

@ -59,6 +59,9 @@
#define ATOM_CMD_TIMEOUT_SEC 20
/* Limit ATOM command table recursion (calltable) to avoid kernel stack overflow. */
#define ATOM_EXECUTE_MAX_DEPTH 32
typedef struct {
struct atom_context *ctx;
uint32_t *ps, *ws;
@ -1229,6 +1232,13 @@ static int amdgpu_atom_execute_table_locked(struct atom_context *ctx, int index,
if (!base)
return -EINVAL;
if (ctx->execute_depth >= ATOM_EXECUTE_MAX_DEPTH) {
DRM_ERROR("atombios command table nesting exceeded limit (%u)\n",
ATOM_EXECUTE_MAX_DEPTH);
return -ELOOP;
}
ctx->execute_depth++;
len = CU16(base + ATOM_CT_SIZE_PTR);
ws = CU8(base + ATOM_CT_WS_PTR);
ps = CU8(base + ATOM_CT_PS_PTR) & ATOM_CT_PS_MASK;
@ -1285,6 +1295,7 @@ static int amdgpu_atom_execute_table_locked(struct atom_context *ctx, int index,
free:
if (ws)
kfree(ectx.ws);
ctx->execute_depth--;
return ret;
}

3
drivers/gpu/drm/amd/amdgpu/atom.h
View File

@ -153,6 +153,9 @@ struct atom_context {
uint8_t vbios_ver_str[STRLEN_NORMAL];
uint8_t date[STRLEN_NORMAL];
uint8_t build_num[STRLEN_NORMAL];
/* Nesting depth for ATOM_OP_CALLTABLE */
unsigned int execute_depth;
};
extern int amdgpu_atom_debug;