drm/amdgpu: fix ucode out-of-bounds read warning
authorjsg <jsg@openbsd.org>
Mon, 9 Sep 2024 09:22:20 +0000 (09:22 +0000)
committerjsg <jsg@openbsd.org>
Mon, 9 Sep 2024 09:22:20 +0000 (09:22 +0000)
From Tim Huang
f2b7a9f3839e92f43559b2795b34640ca8cf839f in linux-6.6.y/6.6.50
8944acd0f9db33e17f387fdc75d33bb473d7936f in mainline linux

sys/dev/pci/drm/amd/amdgpu/amdgpu_cgs.c

index 4f1da12..637cd3f 100644 (file)
@@ -213,6 +213,9 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device,
                struct amdgpu_firmware_info *ucode;
 
                id = fw_type_convert(cgs_device, type);
+               if (id >= AMDGPU_UCODE_ID_MAXIMUM)
+                       return -EINVAL;
+
                ucode = &adev->firmware.ucode[id];
                if (ucode->fw == NULL)
                        return -EINVAL;