[PATCH 2/5] drm/amdgpu: bounds check VBIOS date extraction

[Lijo Lazar]

Bound atom_get_vbios_date() by the BIOS size to avoid out-of-bounds reads.

Signed-off-by: Lijo Lazar <lijo.la...@amd.com>
---
 drivers/gpu/drm/amd/amdgpu/atom.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c 
b/drivers/gpu/drm/amd/amdgpu/atom.c
index 5a4b06dfd096..d18e46422520 100644
--- a/drivers/gpu/drm/amd/amdgpu/atom.c
+++ b/drivers/gpu/drm/amd/amdgpu/atom.c
@@ -59,6 +59,9 @@
 
 #define ATOM_CMD_TIMEOUT_SEC   20
 
+/* Number of raw bytes read at OFFSET_TO_VBIOS_DATE (indices 0..13). */
+#define VBIOS_DATE_LEN         14
+
 /* Limit ATOM command table recursion (calltable) to avoid kernel stack 
overflow. */
 #define ATOM_EXECUTE_MAX_DEPTH 32
 
@@ -1420,6 +1423,11 @@ static void atom_get_vbios_date(struct atom_context *ctx)
 
        p_rom = ctx->bios;
 
+       if (OFFSET_TO_VBIOS_DATE + VBIOS_DATE_LEN > ctx->bios_size) {
+               ctx->date[0] = '\0';
+               return;
+       }
+
        date_in_rom = p_rom + OFFSET_TO_VBIOS_DATE;
 
        ctx->date[0] = '2';
-- 
2.49.0