diff options
| author | Lijo Lazar <lijo.lazar@amd.com> | 2026-06-22 13:35:14 +0530 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2026-07-01 11:17:15 -0400 |
| commit | 0b2becfc28d0af6c2547c290c7d188eafaf0d23d (patch) | |
| tree | e457d24d059ebde8ac359544b470d516034370a8 | |
| parent | 1e453f7e776bbbd4d7848f43fad1e98bb97be673 (diff) | |
| download | linux-stable-0b2becfc28d0af6c2547c290c7d188eafaf0d23d.tar.gz linux-stable-0b2becfc28d0af6c2547c290c7d188eafaf0d23d.zip | |
drm/amdgpu: bounds check atom indirect io method
Bound indirect io method execution by the BIOS size to avoid
out-of-bounds reads.
Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
| -rw-r--r-- | drivers/gpu/drm/amd/amdgpu/atom.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c b/drivers/gpu/drm/amd/amdgpu/atom.c index c3824934ac7d..23f5cd52f9fc 100644 --- a/drivers/gpu/drm/amd/amdgpu/atom.c +++ b/drivers/gpu/drm/amd/amdgpu/atom.c @@ -114,8 +114,10 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base, uint32_t index, uint32_t data) { uint32_t temp = 0xCDCDCDCD; + int start = base; - while (1) + /* IIO opcodes read up to base+3; keep within the BIOS image */ + while (base + 3 < ctx->bios_size) switch (CU8(base)) { case ATOM_IIO_NOP: base++; @@ -180,6 +182,9 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base, pr_info("Unknown IIO opcode\n"); return 0; } + + pr_info("IIO method starting at offset %d runs past BIOS image\n", start); + return 0; } static uint32_t atom_get_src_int(atom_exec_context *ctx, uint8_t attr, |