diff options
| author | Candice Li <candice.li@amd.com> | 2026-05-20 12:33:18 +0800 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2026-06-04 15:26:01 -0400 |
| commit | 9ab125397e9f461f171be383af57886c4eeb8d42 (patch) | |
| tree | 16c98cd913b9c6a0e54d8bf9d4fd9c34d1c77d25 | |
| parent | d2be142124f40be1e5b6c7d25e9f9069bc874c1f (diff) | |
| download | linux-9ab125397e9f461f171be383af57886c4eeb8d42.tar.gz linux-9ab125397e9f461f171be383af57886c4eeb8d42.zip | |
drm/amd/pm: bound OD parameter parsing to stack array size
Reject inputs once parameter_size reaches the array limit, and pass
ARRAY_SIZE(parameter) into parse_input_od_command_lines() for defense in
depth.
Signed-off-by: Candice Li <candice.li@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
| -rw-r--r-- | drivers/gpu/drm/amd/pm/amdgpu_pm.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/drivers/gpu/drm/amd/pm/amdgpu_pm.c b/drivers/gpu/drm/amd/pm/amdgpu_pm.c index 714c702b4f8c..a21d1506e6ab 100644 --- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c +++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c @@ -806,6 +806,8 @@ static ssize_t amdgpu_set_pp_od_clk_voltage(struct device *dev, while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) { if (strlen(sub_str) == 0) continue; + if (parameter_size >= ARRAY_SIZE(parameter)) + return -EINVAL; ret = kstrtol(sub_str, 0, ¶meter[parameter_size]); if (ret) return -EINVAL; @@ -3957,6 +3959,7 @@ static int parse_input_od_command_lines(const char *buf, size_t count, u32 *type, long *params, + size_t params_max, uint32_t *num_of_params) { const char delimiter[3] = {' ', '\n', '\0'}; @@ -3992,6 +3995,9 @@ static int parse_input_od_command_lines(const char *buf, if (strlen(sub_str) == 0) continue; + if (parameter_size >= params_max) + return -EINVAL; + ret = kstrtol(sub_str, 0, ¶ms[parameter_size]); if (ret) return -EINVAL; @@ -4023,6 +4029,7 @@ amdgpu_distribute_custom_od_settings(struct amdgpu_device *adev, count, &cmd_type, parameter, + ARRAY_SIZE(parameter), ¶meter_size); if (ret) return ret; |