DF-1598 / fix.diff
diff --git a/sys/dev/drm/amd/amdgpu/sdma_v2_4.c b/sys/dev/drm/amd/amdgpu/sdma_v2_4.c --- a/sys/dev/drm/amd/amdgpu/sdma_v2_4.c +++ b/sys/dev/drm/amd/amdgpu/sdma_v2_4.c @@ -154,7 +154,9 @@ err = amdgpu_ucode_validate(adev->sdma.instance[i].fw); if (err) goto out; - hdr = (const struct sdma_firmware_header_v1_0 *)adev->sdma.instance[i].fw->data; + if (adev->sdma.instance[i].fw->datasize < sizeof(struct sdma_firmware_header_v1_0)) + goto out; + hdr = (const struct sdma_firmware_header_v1_0 *)adev->sdma.instance[i].fw->data; adev->sdma.instance[i].fw_version = le32_to_cpu(hdr->header.ucode_version); adev->sdma.instance[i].feature_version = le32_to_cpu(hdr->ucode_feature_version); if (adev->sdma.instance[i].feature_version >= 20) |