On Tue, Nov 3, 2026 at 9:21 AM Kang Chen <[email protected]> wrote: > > radeon_atrm_call() trusts the buffer returned by the ATRM method: it > copies obj->buffer.length bytes into the VBIOS image without checking > the object type or that the length fits in the requested chunk. A > firmware-provided ATRM method returning a non-buffer object or a buffer > larger than the requested 4 KiB chunk can write beyond the 256 KiB > VBIOS allocation. > > Reject the response unless it is an ACPI buffer no larger than the > requested chunk. The only caller always requests ATRM_BIOS_PAGE-sized > chunks inside the VBIOS allocation, so checking the returned length > against len is sufficient. > > Fixes: c61e2775873f ("drm/radeon: split ATRM support out from the ATPX > handler (v3)") > Signed-off-by: Kang Chen <[email protected]>
Thanks, this was already fixed: https://patchwork.freedesktop.org/patch/764437/?series=177235&rev=1 Alex > --- > drivers/gpu/drm/radeon/radeon_bios.c | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/radeon/radeon_bios.c > b/drivers/gpu/drm/radeon/radeon_bios.c > index 1da6bf1c17ff..c23892470265 100644 > --- a/drivers/gpu/drm/radeon/radeon_bios.c > +++ b/drivers/gpu/drm/radeon/radeon_bios.c > @@ -183,7 +183,12 @@ static int radeon_atrm_call(acpi_handle atrm_handle, > uint8_t *bios, > } > > obj = (union acpi_object *)buffer.pointer; > - memcpy(bios+offset, obj->buffer.pointer, obj->buffer.length); > + if (!obj || obj->type != ACPI_TYPE_BUFFER || obj->buffer.length > > len) { > + kfree(buffer.pointer); > + return -ENODEV; > + } > + > + memcpy(bios + offset, obj->buffer.pointer, obj->buffer.length); > len = obj->buffer.length; > kfree(buffer.pointer); > return len; > -- > 2.34.1 >
