⬢ DragonFlyBSD Kernel Audit
DF-3585 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/drm/amd/amdgpu/si_dpm.c b/sys/dev/drm/amd/amdgpu/si_dpm.c
--- a/sys/dev/drm/amd/amdgpu/si_dpm.c
+++ b/sys/dev/drm/amd/amdgpu/si_dpm.c
@@ -4404,6 +4404,12 @@ static int si_get_svi2_voltage_table(struct amdgpu_device *adev,
 	if (voltage_dependency_table == NULL)
 		return -EINVAL;
 
+	/* DF-3585: BIOS-supplied dependency count is unclamped (u8, up to 255)
+	 * but atom_voltage_table.entries[] is a fixed MAX_VOLTAGE_ENTRIES array. */
+	if (voltage_dependency_table->count == 0 ||
+	    voltage_dependency_table->count > MAX_VOLTAGE_ENTRIES)
+		return -EINVAL;
+
 	voltage_table->mask_low = 0;
 	voltage_table->phase_delay = 0;
 
@@ -4502,6 +4508,10 @@ static void si_populate_smc_voltage_table(struct amdgpu_device *adev,
 {
 	unsigned int i;
 
+	/* DF-3585: lowSMIO[] is fixed SISLANDS_MAX_NO_VREG_STEPS (32). */
+	if (voltage_table->count > SISLANDS_MAX_NO_VREG_STEPS)
+		return;
+
 	for (i = 0; i < voltage_table->count; i++)
 		table->lowSMIO[i] |= cpu_to_be32(voltage_table->entries[i].smio_low);
 }