diff options
| author | Lijo Lazar <lijo.lazar@amd.com> | 2026-06-15 11:02:51 +0530 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2026-07-01 11:07:36 -0400 |
| commit | 8c3fcfc14fc1320a1155acb2dd7656fce7003bc0 (patch) | |
| tree | b5682ef6ad31b7a74d895bc46de3be872243a657 | |
| parent | 62d8b452615fd7a61976a1372bb81937807968c3 (diff) | |
| download | linux-stable-8c3fcfc14fc1320a1155acb2dd7656fce7003bc0.tar.gz linux-stable-8c3fcfc14fc1320a1155acb2dd7656fce7003bc0.zip | |
drm/amdgpu: Add checks to vbios fetch through ATRM
Check if a valid buffer object is returned after ATRM call. Also, match
the buffer length against requested size before copying.
Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
| -rw-r--r-- | drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c index aa039e148a5e..3ebdd792feec 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c @@ -296,8 +296,14 @@ static int amdgpu_atrm_call(acpi_handle atrm_handle, uint8_t *bios, } obj = (union acpi_object *)buffer.pointer; - memcpy(bios+offset, obj->buffer.pointer, obj->buffer.length); - len = obj->buffer.length; + if (!obj || obj->type != ACPI_TYPE_BUFFER) { + DRM_ERROR("ATRM returned an invalid object\n"); + kfree(buffer.pointer); + return -EINVAL; + } + + len = min_t(size_t, obj->buffer.length, len); + memcpy(bios+offset, obj->buffer.pointer, len); kfree(buffer.pointer); return len; } |