github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

drm/amdgpu: Add size guard before copy discovery binary

Browse Source 
Fix the firmware blob copied into fixed-size buffer without length check.

Signed-off-by: Feifei Xu <Feifei.Xu@amd.com>
Reviewed-by: Le Ma <le.ma@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
Feifei Xu 2026-05-15 14:27:02 +08:00 committed by Alex Deucher
parent ac081deaf1
commit 5ac01ec854
1 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
View File

@ -396,6 +396,26 @@ static int amdgpu_discovery_read_binary_from_file(struct amdgpu_device *adev,
return r;
}
if (fw->size > adev->discovery.size) {
dev_err(adev->dev,
"ip discovery firmware \"%s\" too large (%zu > %u)\n",
fw_name, fw->size, adev->discovery.size);
release_firmware(fw);
return -EINVAL;
}
/* Ensure the firmware is at least large enough to contain the
* binary header fields.
*/
if (fw->size < offsetof(struct binary_header, binary_size) +
sizeof(((struct binary_header *)0)->binary_size)) {
dev_err(adev->dev,
"ip discovery firmware \"%s\" too small (%zu)\n",
fw_name, fw->size);
release_firmware(fw);
return -EINVAL;
}
memcpy((u8 *)binary, (u8 *)fw->data, fw->size);
release_firmware(fw);