diff options
| author | Lijo Lazar <lijo.lazar@amd.com> | 2026-06-16 10:14:58 +0530 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2026-07-01 11:14:50 -0400 |
| commit | be88697602238c3dcb47bbc2db1eef923f63e78b (patch) | |
| tree | d428d8b98e12147992ed169c4f37e508ffaf90e8 /drivers/gpu/drm/amd/amdgpu/atom.h | |
| parent | 230753e46a4a9d04dad6a9b5dbaeb7fd52add7d0 (diff) | |
| download | linux-next-be88697602238c3dcb47bbc2db1eef923f63e78b.tar.gz linux-next-be88697602238c3dcb47bbc2db1eef923f63e78b.zip | |
drm/amdgpu: bounds check ATOM IIO table parsing
atom_index_iio() parsed the IIO bytecode without bounds checks, allowing
out-of-bounds reads on a malformed VBIOS. Pass the BIOS size into
amdgpu_atom_parse() and bound the parse loops by it.
Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Assisted-by: Claude Code
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Asad Kamal <asad.kamal@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/atom.h')
| -rw-r--r-- | drivers/gpu/drm/amd/amdgpu/atom.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/gpu/drm/amd/amdgpu/atom.h b/drivers/gpu/drm/amd/amdgpu/atom.h index bb3d9eb7eb6b..4687c019cbe3 100644 --- a/drivers/gpu/drm/amd/amdgpu/atom.h +++ b/drivers/gpu/drm/amd/amdgpu/atom.h @@ -133,6 +133,7 @@ struct atom_context { struct card_info *card; struct mutex mutex; void *bios; + uint32_t bios_size; uint32_t cmd_table, data_table; uint16_t *iio; @@ -160,7 +161,7 @@ struct atom_context { extern int amdgpu_atom_debug; -struct atom_context *amdgpu_atom_parse(struct card_info *card, void *bios); +struct atom_context *amdgpu_atom_parse(struct card_info *card, void *bios, uint32_t bios_size); int amdgpu_atom_execute_table(struct atom_context *ctx, int index, uint32_t *params, int params_size); int amdgpu_atom_asic_init(struct atom_context *ctx); void amdgpu_atom_destroy(struct atom_context *ctx); |