DF-1496 / fix.diff
diff --git a/sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c b/sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c --- a/sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c +++ b/sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c @@ -1370,6 +1370,15 @@ GetIndexIntoMasterTable(DATA, SMU_Info), &size, &frev, &crev); + /* DF-1496: smu_atom_get_data_table may return NULL on parse failure; + * dereferencing it panics. */ + PP_ASSERT_WITH_CODE((NULL != psmu_info), + "Invalid SMU_Info VBIOS table!", return -EINVAL); + /* ucSclkEntryNum is a UCHAR from the VBIOS with no bound check; the dest + * table->entry[] is fixed at MAX_SCLK_RANGE (8) and callers place it on + * the stack. Cap the loop to avoid a stack smash. */ + PP_ASSERT_WITH_CODE((psmu_info->ucSclkEntryNum <= MAX_SCLK_RANGE), + "Invalid SMU_Info ucSclkEntryNum!", return -EINVAL); for (i = 0; i < psmu_info->ucSclkEntryNum; i++) { table->entry[i].ucVco_setting = psmu_info->asSclkFcwRangeEntry[i].ucVco_setting; |