From: Tristan Madani <[email protected]>
radeon_atrm_call() copies the ACPI ATRM method return data without
checking that the returned object is actually a buffer or that its
length fits within the caller-provided size. If the ATRM method
returns a non-buffer object type or an oversized buffer, the memcpy
writes past the destination bounds.
Add a NULL pointer check and ACPI_TYPE_BUFFER type validation before
accessing the buffer fields, and clamp the copy length to the
requested size. This matches the validation already present in the
amdgpu counterpart amdgpu_atrm_call().
Fixes: c61e2775873f ("drm/radeon: split ATRM support out from the ATPX handler
(v3)")
Cc: [email protected]
Signed-off-by: Tristan Madani <[email protected]>
---
drivers/gpu/drm/radeon/radeon_bios.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_bios.c
b/drivers/gpu/drm/radeon/radeon_bios.c
index 1da6bf1c17ff3..579ba1c1f23a4 100644
--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -183,8 +183,13 @@ static int radeon_atrm_call(acpi_handle atrm_handle,
uint8_t *bios,
}
obj = (union acpi_object *)buffer.pointer;
- memcpy(bios+offset, obj->buffer.pointer, obj->buffer.length);
- len = obj->buffer.length;
+ if (!obj || obj->type != ACPI_TYPE_BUFFER) {
+ kfree(buffer.pointer);
+ return -EINVAL;
+ }
+
+ len = min_t(size_t, obj->buffer.length, len);
+ memcpy(bios + offset, obj->buffer.pointer, len);
kfree(buffer.pointer);
return len;
}
--
2.47.3
