Applied. Thanks!
On Mon, Sep 14, 2026 at 10:36 AM Hari Mishal <[email protected]> wrote: > > atomctrl_get_smc_sclk_range_table() copies ucSclkEntryNum entries from > the VBIOS SMU_Info table into pp_atom_ctrl_sclk_range_table. Both the > source (asSclkFcwRangeEntry[]) and destination (table->entry[]) arrays > are fixed at MAX_SCLK_RANGE (8) entries, but ucSclkEntryNum is an > unchecked u8 read straight from the VBIOS, so it can be up to 255. The > destination is stack-allocated in both callers > (polaris10_get_sclk_range_table(), vegam_get_sclk_range_table()), so a > count above 8 overflows a stack buffer, not just a heap read. > > Reject counts above MAX_SCLK_RANGE rather than clamping to it. Only > one version of this VBIOS struct (ATOM_SMU_INFO_V2_1) has ever > existed, so a count above 8 corresponds to no legitimate table format > and means either a corrupted or a tampered VBIOS. > > Fixes: a23eefa2f461 ("drm/amd/powerplay: enable dpm for baffin.") > Assisted-by: gkh_clanker_t1000 > Signed-off-by: Hari Mishal <[email protected]> > --- > drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c > b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c > index 4b796d60b03d..3217ad3c1d17 100644 > --- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c > +++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c > @@ -1025,6 +1025,9 @@ int atomctrl_get_smc_sclk_range_table(struct pp_hwmgr > *hwmgr, struct pp_atom_ctr > if (!psmu_info) > return -EINVAL; > > + if (psmu_info->ucSclkEntryNum > MAX_SCLK_RANGE) > + return -EINVAL; > + > for (i = 0; i < psmu_info->ucSclkEntryNum; i++) { > table->entry[i].ucVco_setting = > psmu_info->asSclkFcwRangeEntry[i].ucVco_setting; > table->entry[i].ucPostdiv = > psmu_info->asSclkFcwRangeEntry[i].ucPostdiv; > -- > 2.43.0 >
