drm/amd/pm: Validate Tonga PowerPlay state array bounds

Browse source

process_pptables_v1_0.c builds the Tonga state array pointer
from usStateArrayOffset before checking that the table buffer covers
the referenced data. A truncated PowerPlay table can therefore lead to
out-of-bounds reads while validating the state array.

Validate the fixed table size first, then check the state array offset
and entry range before dereferencing the state array.

Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

...

This commit is contained in:

Yang Wang 2026-06-23 11:36:39 +08:00 • committed by Alex Deucher

parent c4a5160e3b

commit 1ac24df78c

1 changed files with 40 additions and 22 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

62

drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c

View file