On Mon, Jun 15, 2026 at 2:04 AM Lijo Lazar <[email protected]> wrote: > > Check if a valid buffer object is returned after ATRM call. Also, match > the buffer length against requested size before copying. > > Signed-off-by: Lijo Lazar <[email protected]>
Reviewed-by: Alex Deucher <[email protected]> > --- > drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 10 ++++++++-- > 1 file changed, 8 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c > b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c > index aa039e148a5e..3ebdd792feec 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c > @@ -296,8 +296,14 @@ static int amdgpu_atrm_call(acpi_handle atrm_handle, > uint8_t *bios, > } > > obj = (union acpi_object *)buffer.pointer; > - memcpy(bios+offset, obj->buffer.pointer, obj->buffer.length); > - len = obj->buffer.length; > + if (!obj || obj->type != ACPI_TYPE_BUFFER) { > + DRM_ERROR("ATRM returned an invalid object\n"); > + kfree(buffer.pointer); > + return -EINVAL; > + } > + > + len = min_t(size_t, obj->buffer.length, len); > + memcpy(bios+offset, obj->buffer.pointer, len); > kfree(buffer.pointer); > return len; > } > -- > 2.49.0 >
