diff options
| author | Jonathan Gray <jsg@cvs.openbsd.org> | 2024-11-01 02:49:28 +0000 |
|---|---|---|
| committer | Jonathan Gray <jsg@cvs.openbsd.org> | 2024-11-01 02:49:28 +0000 |
| commit | 40153ed89ef7922d1b945a02a198e2bc0027d49d (patch) | |
| tree | 6eaca0a079aa13b7a781b08f0d2e25d7f41fec69 /sys/dev/pci/drm | |
| parent | d13f16ffce13c44f9fd57b683982bfbd6d28824e (diff) | |
drm/amd: Guard against bad data for ATIF ACPI method
From Mario Limonciello
975ede2a7bec52b5da1428829b3439667c8a234b in linux-6.6.y/6.6.59
bf58f03931fdcf7b3c45cb76ac13244477a60f44 in mainline linux
Diffstat (limited to 'sys/dev/pci/drm')
| -rw-r--r-- | sys/dev/pci/drm/amd/amdgpu/amdgpu_acpi.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_acpi.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_acpi.c index 8e326af9c96..b8a44fb38ed 100644 --- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_acpi.c +++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_acpi.c @@ -149,6 +149,7 @@ static union acpi_object *amdgpu_atif_call(struct amdgpu_atif *atif, struct acpi_buffer *params) { acpi_status status; + union acpi_object *obj; union acpi_object atif_arg_elements[2]; struct acpi_object_list atif_arg; struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; @@ -171,16 +172,24 @@ static union acpi_object *amdgpu_atif_call(struct amdgpu_atif *atif, status = acpi_evaluate_object(atif->handle, NULL, &atif_arg, &buffer); + obj = (union acpi_object *)buffer.pointer; - /* Fail only if calling the method fails and ATIF is supported */ + /* Fail if calling the method fails and ATIF is supported */ if (ACPI_FAILURE(status) && status != AE_NOT_FOUND) { DRM_DEBUG_DRIVER("failed to evaluate ATIF got %s\n", acpi_format_exception(status)); - kfree(buffer.pointer); + kfree(obj); return NULL; } - return buffer.pointer; + if (obj->type != ACPI_TYPE_BUFFER) { + DRM_DEBUG_DRIVER("bad object returned from ATIF: %d\n", + obj->type); + kfree(obj); + return NULL; + } + + return obj; } /** |