drm/amdgpu: bounds check ATOM IIO table parsing

Browse source

atom_index_iio() parsed the IIO bytecode without bounds checks, allowing
out-of-bounds reads on a malformed VBIOS. Pass the BIOS size into
amdgpu_atom_parse() and bound the parse loops by it.

Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Assisted-by: Claude Code
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Asad Kamal <asad.kamal@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

...

This commit is contained in:

Lijo Lazar 2026-06-16 10:14:58 +05:30 • committed by Alex Deucher

parent 230753e46a

commit be88697602

3 changed files with 23 additions and 7 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c

View file

25

drivers/gpu/drm/amd/amdgpu/atom.c

View file

3

drivers/gpu/drm/amd/amdgpu/atom.h

View file