[PATCH 7/8] drm/amd/pm: bound OD parameter parsing to stack array size

[Candice Li]

Reject inputs once parameter_size reaches the array limit, and pass
ARRAY_SIZE(parameter) into parse_input_od_command_lines() for defense in
depth.

Signed-off-by: Candice Li <candice...@amd.com>
---
 drivers/gpu/drm/amd/pm/amdgpu_pm.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/amd/pm/amdgpu_pm.c 
b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
index 8140bc77591c3e..60db9b66d08c20 100644
--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
@@ -798,6 +798,8 @@ static ssize_t amdgpu_set_pp_od_clk_voltage(struct device 
*dev,
        while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) {
                if (strlen(sub_str) == 0)
                        continue;
+               if (parameter_size >= ARRAY_SIZE(parameter))
+                       return -EINVAL;
                ret = kstrtol(sub_str, 0, &parameter[parameter_size]);
                if (ret)
                        return -EINVAL;
@@ -3931,6 +3933,7 @@ static int parse_input_od_command_lines(const char *buf,
                                        size_t count,
                                        u32 *type,
                                        long *params,
+                                       size_t params_max,
                                        uint32_t *num_of_params)
 {
        const char delimiter[3] = {' ', '\n', '\0'};
@@ -3966,6 +3969,9 @@ static int parse_input_od_command_lines(const char *buf,
                if (strlen(sub_str) == 0)
                        continue;
 
+               if (parameter_size >= params_max)
+                       return -EINVAL;
+
                ret = kstrtol(sub_str, 0, &params[parameter_size]);
                if (ret)
                        return -EINVAL;
@@ -3997,6 +4003,7 @@ amdgpu_distribute_custom_od_settings(struct amdgpu_device 
*adev,
                                           count,
                                           &cmd_type,
                                           parameter,
+                                          ARRAY_SIZE(parameter),
                                           &parameter_size);
        if (ret)
                return ret;
-- 
2.25.1