DragonFlyBSD Kernel Audit
DF-1496 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c b/sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c
--- a/sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c
+++ b/sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c
@@ -1370,6 +1370,15 @@
 			GetIndexIntoMasterTable(DATA, SMU_Info),
 			&size, &frev, &crev);
 
+	/* DF-1496: smu_atom_get_data_table may return NULL on parse failure;
+	 * dereferencing it panics. */
+	PP_ASSERT_WITH_CODE((NULL != psmu_info),
+		"Invalid SMU_Info VBIOS table!", return -EINVAL);
+	/* ucSclkEntryNum is a UCHAR from the VBIOS with no bound check; the dest
+	 * table->entry[] is fixed at MAX_SCLK_RANGE (8) and callers place it on
+	 * the stack. Cap the loop to avoid a stack smash. */
+	PP_ASSERT_WITH_CODE((psmu_info->ucSclkEntryNum <= MAX_SCLK_RANGE),
+		"Invalid SMU_Info ucSclkEntryNum!", return -EINVAL);
 
 	for (i = 0; i < psmu_info->ucSclkEntryNum; i++) {
 		table->entry[i].ucVco_setting = psmu_info->asSclkFcwRangeEntry[i].ucVco_setting;