drm/amd/pm: Validate Vega hwmgr PowerPlay table bounds

Browse source

The Vega hwmgr PowerPlay table parsers read fixed table fields,
state array entries, or SMC PPT fields before validating that the
VBIOS table buffer covers those structures. A truncated table can
therefore lead to out-of-bounds reads during hwmgr initialization.

Reject tables smaller than the fixed PowerPlay table. For Vega10, also
validate the state array offset and entry range before dereferencing
the state array.

Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

...

This commit is contained in:

Yang Wang 2026-06-23 11:37:23 +08:00 • committed by Alex Deucher

parent 1ac24df78c

commit 3a8d8e0b7f

3 changed files with 52 additions and 21 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

59

drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c

View file

7

drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_processpptables.c

View file

7

drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_processpptables.c

View file