diff options
| author | Alexander Richards <electrodeyt@gmail.com> | 2024-01-11 18:04:48 +0300 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2024-01-16 02:35:37 +0300 |
| commit | 4630d5031cd87438cc14a4619b8d4148eef1405e (patch) | |
| tree | b38dcfdb2613a215e81b60833525f21e187ba5eb /drivers/gpu/drm/amd/pm/swsmu | |
| parent | a25dea474a24ee7d1a2688f13092357d947dee0f (diff) | |
| download | linux-4630d5031cd87438cc14a4619b8d4148eef1405e.tar.xz | |
drm/amdgpu: check PS, WS index
Theoretically, it would be possible for a buggy or malicious VBIOS to
overwrite past the bounds of the passed parameters (or its own
workspace); add bounds checking to prevent this from happening.
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3093
Signed-off-by: Alexander Richards <electrodeyt@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu/drm/amd/pm/swsmu')
| -rw-r--r-- | drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 2 | ||||
| -rw-r--r-- | drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c index 5a314d0316c1..2e7f8d5cfc28 100644 --- a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c +++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c @@ -514,7 +514,7 @@ static int smu_v11_0_atom_get_smu_clockinfo(struct amdgpu_device *adev, getsmuclockinfo); ret = amdgpu_atom_execute_table(adev->mode_info.atom_context, index, - (uint32_t *)&input); + (uint32_t *)&input, sizeof(input)); if (ret) return -EINVAL; diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c index 5e408a195860..ed15f5a0fd11 100644 --- a/drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c +++ b/drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c @@ -301,7 +301,7 @@ static int smu_v12_0_atom_get_smu_clockinfo(struct amdgpu_device *adev, getsmuclockinfo); ret = amdgpu_atom_execute_table(adev->mode_info.atom_context, index, - (uint32_t *)&input); + (uint32_t *)&input, sizeof(input)); if (ret) return -EINVAL; |