From f35aa5c77f5fca20fc269d6221df19c7b96704a5 Mon Sep 17 00:00:00 2001 From: Hari Mishal Date: Mon, 14 Sep 2026 15:29:20 +0200 Subject: [PATCH] drm/amd/pm: bound SCLK FCW range entries to the table size atomctrl_get_smc_sclk_range_table() copies ucSclkEntryNum entries from the VBIOS SMU_Info table into pp_atom_ctrl_sclk_range_table. Both the source (asSclkFcwRangeEntry[]) and destination (table->entry[]) arrays are fixed at MAX_SCLK_RANGE (8) entries, but ucSclkEntryNum is an unchecked u8 read straight from the VBIOS, so it can be up to 255. The destination is stack-allocated in both callers (polaris10_get_sclk_range_table(), vegam_get_sclk_range_table()), so a count above 8 overflows a stack buffer, not just a heap read. Reject counts above MAX_SCLK_RANGE rather than clamping to it. Only one version of this VBIOS struct (ATOM_SMU_INFO_V2_1) has ever existed, so a count above 8 corresponds to no legitimate table format and means either a corrupted or a tampered VBIOS. Fixes: a23eefa2f461 ("drm/amd/powerplay: enable dpm for baffin.") Assisted-by: gkh_clanker_t1000 Signed-off-by: Hari Mishal Signed-off-by: Alex Deucher --- drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c index 4b796d60b03d..3217ad3c1d17 100644 --- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c +++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c @@ -1025,6 +1025,9 @@ int atomctrl_get_smc_sclk_range_table(struct pp_hwmgr *hwmgr, struct pp_atom_ctr if (!psmu_info) return -EINVAL; + if (psmu_info->ucSclkEntryNum > MAX_SCLK_RANGE) + return -EINVAL; + for (i = 0; i < psmu_info->ucSclkEntryNum; i++) { table->entry[i].ucVco_setting = psmu_info->asSclkFcwRangeEntry[i].ucVco_setting; table->entry[i].ucPostdiv = psmu_info->asSclkFcwRangeEntry[i].ucPostdiv;