Reviewed and applied. Thanks!
On Fri, Oct 30, 2026 at 5:13 AM Tristan Madani <[email protected]> wrote: > > From: Tristan Madani <[email protected]> > > radeon_atrm_call() copies the ACPI ATRM method return data without > checking that the returned object is actually a buffer or that its > length fits within the caller-provided size. If the ATRM method > returns a non-buffer object type or an oversized buffer, the memcpy > writes past the destination bounds. > > Add a NULL pointer check and ACPI_TYPE_BUFFER type validation before > accessing the buffer fields, and clamp the copy length to the > requested size. This matches the validation already present in the > amdgpu counterpart amdgpu_atrm_call(). > > Fixes: c61e2775873f ("drm/radeon: split ATRM support out from the ATPX > handler (v3)") > Cc: [email protected] > Signed-off-by: Tristan Madani <[email protected]> > --- > drivers/gpu/drm/radeon/radeon_bios.c | 9 +++++++-- > 1 file changed, 7 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/radeon/radeon_bios.c > b/drivers/gpu/drm/radeon/radeon_bios.c > index 1da6bf1c17ff3..579ba1c1f23a4 100644 > --- a/drivers/gpu/drm/radeon/radeon_bios.c > +++ b/drivers/gpu/drm/radeon/radeon_bios.c > @@ -183,8 +183,13 @@ static int radeon_atrm_call(acpi_handle atrm_handle, > uint8_t *bios, > } > > obj = (union acpi_object *)buffer.pointer; > - memcpy(bios+offset, obj->buffer.pointer, obj->buffer.length); > - len = obj->buffer.length; > + if (!obj || obj->type != ACPI_TYPE_BUFFER) { > + kfree(buffer.pointer); > + return -EINVAL; > + } > + > + len = min_t(size_t, obj->buffer.length, len); > + memcpy(bios + offset, obj->buffer.pointer, len); > kfree(buffer.pointer); > return len; > } > -- > 2.47.3 >
