⬢ DragonFlyBSD Kernel Audit
DF-4666 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c
+++ b/sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c
@@ -423,7 +423,15 @@ uint8_t phm_get_voltage_id(pp_atomctrl_voltage_
 uint16_t phm_find_closest_vddci(struct pp_atomctrl_voltage_table *vddci_table, uint16_t vddci)
 {
 	uint32_t  i;
 
+	/*
+	 * Sibling lookups (phm_get_voltage_index / phm_get_voltage_id) reject
+	 * empty tables; without this guard the fallback below indexes
+	 * entries[(uint32_t)0 - 1] and reads ~32 GiB out of bounds.
+	 */
+	if (vddci_table == NULL || vddci_table->count == 0 ||
+	    vddci_table->count > PP_ATOMCTRL_MAX_VOLTAGE_ENTRIES)
+		return vddci;
+
 	for (i = 0; i < vddci_table->count; i++) {
 		if (vddci_table->entries[i].value >= vddci)
 			return vddci_table->entries[i].value;
 	}