AMD General Reviewed-by: Hawking Zhang <[email protected]>
Regards, Hawking -----Original Message----- From: Lazar, Lijo <[email protected]> Sent: Monday, June 22, 2026 5:31 PM To: [email protected] Cc: Zhang, Hawking <[email protected]>; Deucher, Alexander <[email protected]> Subject: [PATCH] drm/amdgpu: bounds check atom indirect io method Bound indirect io method execution by the BIOS size to avoid out-of-bounds reads. Signed-off-by: Lijo Lazar <[email protected]> --- drivers/gpu/drm/amd/amdgpu/atom.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c b/drivers/gpu/drm/amd/amdgpu/atom.c index 0d5be1795972..d4a652d2b453 100644 --- a/drivers/gpu/drm/amd/amdgpu/atom.c +++ b/drivers/gpu/drm/amd/amdgpu/atom.c @@ -114,8 +114,10 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base, uint32_t index, uint32_t data) { uint32_t temp = 0xCDCDCDCD; + int start = base; - while (1) + /* IIO opcodes read up to base+3; keep within the BIOS image */ + while (base + 3 < ctx->bios_size) switch (CU8(base)) { case ATOM_IIO_NOP: base++; @@ -180,6 +182,9 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base, pr_info("Unknown IIO opcode\n"); return 0; } + + pr_info("IIO method starting at offset %d runs past BIOS image\n", start); + return 0; } static uint32_t atom_get_src_int(atom_exec_context *ctx, uint8_t attr, -- 2.49.0
