⬢ DragonFlyBSD Kernel Audit
DF-3888 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/drm/amd/amdgpu/kv_dpm.c
+++ b/sys/dev/drm/amd/amdgpu/kv_dpm.c
@@ -1778,6 +1778,11 @@
 	struct amdgpu_clock_voltage_dependency_table *table =
 		&adev->pm.dpm.dyn_state.vddc_dependency_on_sclk;
 
+	/* num_levels stays 0 for a VBIOS state with no valid clock entries;
+	 * levels[num_levels - 1] would be a wild read. */
+	if (new_ps->num_levels == 0)
+		return;
+
 	if (table && table->count) {
 		for (i = 0; i < pi->graphics_dpm_level_count; i++) {
 			if ((table->entries[i].clk >= new_ps->levels[0].sclk) ||
@@ -2932,6 +2937,11 @@
 	struct kv_power_info *pi = kv_get_pi(adev);
 	struct kv_ps *requested_state = kv_get_ps(&pi->requested_rps);
 
+	/* A VBIOS state with zero valid clock levels leaves num_levels == 0;
+	 * levels[num_levels - 1] would read ~48 GB out of bounds. */
+	if (!requested_state || requested_state->num_levels == 0)
+		return 0;
+
 	if (low)
 		return requested_state->levels[0].sclk;
 	else