Summary

radeon_ucode_validate (radeon_ucode.c:156-165) is sole firmware validation gate for entire radeon DRM driver yet only checks fw->datasize == le32_to_cpu(hdr->size_bytes). No NULL check on fw->data (firmware_register sets data from module param no NULL guard); no minimum-size check sizeof(common_firmware_header)=32 bytes; reading hdr->size_bytes at offset 0 is itself OOB when datasize<4; no validation that ucode_array_offset_bytes + ucode_size_bytes fits within image. Attacker placing crafted firmware kernel module can trigger: (1) NULL deref kernel panic when data==NULL datasize=0 hdr=NULL hdr->size_bytes derefs NULL; (2) OOB read of hdr->size_bytes itself when datasize 1/2/3 bytes; (3) once validation passes with small matching size OOB reads of up to 20+ bytes past buffer in all 5 radeon_ucode_print_*_hdr debug functions (DRM_DEBUG expands to drm_dbg EXPORT_SYMBOL so all args evaluated unconditionally even when drm_debug==0) plus unbounded OOB reads in downstream callers si.c/cik.c/cik_sdma.c/radeon_uvd.c using unchecked offset/size fields for pointer arithmetic and loop bounds. Sibling amdgpu_ucode.c:251 has identical bug. Threat: root/boot-filesystem control (NFS root removable media PXE supply-chain). Impact: kernel panic DoS via NULL deref; OOB heap read of adjacent kernel memory; potential info leak if drm_debug enabled leaked values printed to dmesg.