DragonFlyBSD Kernel Audit
DF-1598 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/drm/amd/amdgpu/sdma_v2_4.c b/sys/dev/drm/amd/amdgpu/sdma_v2_4.c
--- a/sys/dev/drm/amd/amdgpu/sdma_v2_4.c
+++ b/sys/dev/drm/amd/amdgpu/sdma_v2_4.c
@@ -154,7 +154,9 @@
 		err = amdgpu_ucode_validate(adev->sdma.instance[i].fw);
 		if (err)
 			goto out;
-		hdr = (const struct sdma_firmware_header_v1_0 *)adev->sdma.instance[i].fw->data;
+		if (adev->sdma.instance[i].fw->datasize < sizeof(struct sdma_firmware_header_v1_0))
+			goto out;
+	hdr = (const struct sdma_firmware_header_v1_0 *)adev->sdma.instance[i].fw->data;
 		adev->sdma.instance[i].fw_version = le32_to_cpu(hdr->header.ucode_version);
 		adev->sdma.instance[i].feature_version = le32_to_cpu(hdr->ucode_feature_version);
 		if (adev->sdma.instance[i].feature_version >= 20)