diff options
| author | Jonathan Gray <jsg@cvs.openbsd.org> | 2024-09-09 10:00:21 +0000 |
|---|---|---|
| committer | Jonathan Gray <jsg@cvs.openbsd.org> | 2024-09-09 10:00:21 +0000 |
| commit | c9eba27f55ab3ca7f0fc79f2d80b9831fc7658a2 (patch) | |
| tree | 88b236d9c5931c72864b151bcabd52aed612ea2c | |
| parent | 2ac9db6fec56ce1656b180e0b05cd0d4f67a43b1 (diff) | |
drm/amd/display: Check BIOS images before it is used
From Alex Hung
e50bec62acaeec03afc6fa5dfb2426e52d049cf5 in linux-6.6.y/6.6.50
8b0ddf19cca2a352b2a7e01d99d3ba949a99c84c in mainline linux
| -rw-r--r-- | sys/dev/pci/drm/amd/display/dc/bios/bios_parser.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/sys/dev/pci/drm/amd/display/dc/bios/bios_parser.c b/sys/dev/pci/drm/amd/display/dc/bios/bios_parser.c index 19cd1bd844d..684b005f564 100644 --- a/sys/dev/pci/drm/amd/display/dc/bios/bios_parser.c +++ b/sys/dev/pci/drm/amd/display/dc/bios/bios_parser.c @@ -667,6 +667,9 @@ static enum bp_result get_ss_info_v3_1( ss_table_header_include = ((ATOM_ASIC_INTERNAL_SS_INFO_V3 *) bios_get_image(&bp->base, DATA_TABLES(ASIC_InternalSS_Info), struct_size(ss_table_header_include, asSpreadSpectrum, 1))); + if (!ss_table_header_include) + return BP_RESULT_UNSUPPORTED; + table_size = (le16_to_cpu(ss_table_header_include->sHeader.usStructureSize) - sizeof(ATOM_COMMON_TABLE_HEADER)) @@ -1036,6 +1039,8 @@ static enum bp_result get_ss_info_from_internal_ss_info_tbl_V2_1( &bp->base, DATA_TABLES(ASIC_InternalSS_Info), struct_size(header, asSpreadSpectrum, 1))); + if (!header) + return result; memset(info, 0, sizeof(struct spread_spectrum_info)); @@ -1109,6 +1114,8 @@ static enum bp_result get_ss_info_from_ss_info_table( get_atom_data_table_revision(header, &revision); tbl = GET_IMAGE(ATOM_SPREAD_SPECTRUM_INFO, DATA_TABLES(SS_Info)); + if (!tbl) + return result; if (1 != revision.major || 2 > revision.minor) return result; @@ -1636,6 +1643,8 @@ static uint32_t get_ss_entry_number_from_ss_info_tbl( tbl = GET_IMAGE(ATOM_SPREAD_SPECTRUM_INFO, DATA_TABLES(SS_Info)); + if (!tbl) + return number; if (1 != revision.major || 2 > revision.minor) return number; @@ -1718,6 +1727,8 @@ static uint32_t get_ss_entry_number_from_internal_ss_info_tbl_v2_1( &bp->base, DATA_TABLES(ASIC_InternalSS_Info), struct_size(header_include, asSpreadSpectrum, 1))); + if (!header_include) + return 0; size = (le16_to_cpu(header_include->sHeader.usStructureSize) - sizeof(ATOM_COMMON_TABLE_HEADER)) @@ -1756,6 +1767,9 @@ static uint32_t get_ss_entry_number_from_internal_ss_info_tbl_V3_1( header_include = ((ATOM_ASIC_INTERNAL_SS_INFO_V3 *) bios_get_image(&bp->base, DATA_TABLES(ASIC_InternalSS_Info), struct_size(header_include, asSpreadSpectrum, 1))); + if (!header_include) + return number; + size = (le16_to_cpu(header_include->sHeader.usStructureSize) - sizeof(ATOM_COMMON_TABLE_HEADER)) / sizeof(ATOM_ASIC_SS_ASSIGNMENT_V3); |