DragonFlyBSD Kernel Audit
DF-1136 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/drm/radeon/si_dpm.c b/sys/dev/drm/radeon/si_dpm.c
--- a/sys/dev/drm/radeon/si_dpm.c
+++ b/sys/dev/drm/radeon/si_dpm.c
@@ -3949,6 +3949,14 @@
 	voltage_table->phase_delay = 0;
 
 	voltage_table->count = voltage_dependency_table->count;
+	/* count is sourced from VBIOS power tables and is otherwise
+	 * unbounded; entries[] is a fixed MAX_VOLTAGE_ENTRIES (32) array.
+	 * Clamp to avoid overwriting the evergreen_power_info fields that
+	 * follow the table (cac_weights / powertune pointers).  The GPIO
+	 * voltage path already trims via si_trim_voltage_table_to_fit;
+	 * this SVI2 path did not. */
+	if (voltage_table->count > MAX_VOLTAGE_ENTRIES)
+		voltage_table->count = MAX_VOLTAGE_ENTRIES;
 	for (i = 0; i < voltage_table->count; i++) {
 		voltage_table->entries[i].value = voltage_dependency_table->entries[i].v;
 		voltage_table->entries[i].smio_low = 0;