Hello,
In atom_get_vbios_pn(), when the part-number string is empty and
atom_find_str_in_rom() cannot find the ATOMBIOS anchor, the fallback
computes NULL + sizeof(BIOS_ATOM_PREFIX) - 1, i.e. (unsigned char *)8:
vbios_str = atom_find_str_in_rom(ctx, BIOS_ATOM_PREFIX, 3, 1024, 64);
if (vbios_str == NULL)
vbios_str += sizeof(BIOS_ATOM_PREFIX) - 1;
The subsequent range check is false for a near-NULL pointer, so the
value survives and *vbios_str dereferences address 8 - a NULL-page oops
during probe with a malformed VBIOS that passes the magic checks. The
recent hardening of the neighboring date/version/build helpers closed
their OOB reads; this fallback path was left intact.
Simply leave the part number empty when the anchor is not found.
Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd
(v7.4-rc1, 2026-11-07), drivers/gpu/drm/amd/amdgpu/atom.c:1491-1503
(atom_get_vbios_pn).
Pointer-arithmetic-on-NULL is pre-existing; this window's hardening series made
it the sole fallback outcome.
This was found during an assisted (AI-supported) static source review of
mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every
code path cited below was re-verified by the
reporter against that tree. The patch below has NOT been compiled and has
NOT been runtime tested, and no reproducer was produced - the triggering
conditions are described above instead. Please treat this as a report for
verification rather than a battle-tested fix.
Reported-by: Noah Weinberger <[email protected]>
---
diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c
b/drivers/gpu/drm/amd/amdgpu/atom.c
index 1a599d5..7598606 100644
--- a/drivers/gpu/drm/amd/amdgpu/atom.c
+++ b/drivers/gpu/drm/amd/amdgpu/atom.c
@@ -1493,8 +1493,6 @@ static void atom_get_vbios_pn(struct atom_context *ctx)
if (vbios_str == NULL || *vbios_str == 0) {
vbios_str = atom_find_str_in_rom(ctx, BIOS_ATOM_PREFIX, 3,
1024, 64);
- if (vbios_str == NULL)
- vbios_str += sizeof(BIOS_ATOM_PREFIX) - 1;
if (vbios_str >= p_rom + ctx->bios_size)
vbios_str = NULL;
}
