From 40153ed89ef7922d1b945a02a198e2bc0027d49d Mon Sep 17 00:00:00 2001 From: Jonathan Gray Date: Fri, 1 Nov 2024 02:49:28 +0000 Subject: drm/amd: Guard against bad data for ATIF ACPI method From Mario Limonciello 975ede2a7bec52b5da1428829b3439667c8a234b in linux-6.6.y/6.6.59 bf58f03931fdcf7b3c45cb76ac13244477a60f44 in mainline linux --- sys/dev/pci/drm/amd/amdgpu/amdgpu_acpi.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) (limited to 'sys/dev/pci/drm/amd/amdgpu') diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_acpi.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_acpi.c index 8e326af9c96..b8a44fb38ed 100644 --- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_acpi.c +++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_acpi.c @@ -149,6 +149,7 @@ static union acpi_object *amdgpu_atif_call(struct amdgpu_atif *atif, struct acpi_buffer *params) { acpi_status status; + union acpi_object *obj; union acpi_object atif_arg_elements[2]; struct acpi_object_list atif_arg; struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; @@ -171,16 +172,24 @@ static union acpi_object *amdgpu_atif_call(struct amdgpu_atif *atif, status = acpi_evaluate_object(atif->handle, NULL, &atif_arg, &buffer); + obj = (union acpi_object *)buffer.pointer; - /* Fail only if calling the method fails and ATIF is supported */ + /* Fail if calling the method fails and ATIF is supported */ if (ACPI_FAILURE(status) && status != AE_NOT_FOUND) { DRM_DEBUG_DRIVER("failed to evaluate ATIF got %s\n", acpi_format_exception(status)); - kfree(buffer.pointer); + kfree(obj); return NULL; } - return buffer.pointer; + if (obj->type != ACPI_TYPE_BUFFER) { + DRM_DEBUG_DRIVER("bad object returned from ATIF: %d\n", + obj->type); + kfree(obj); + return NULL; + } + + return obj; } /** -- cgit v1.2.3