diff options
| author | Ernst Sjöstrand <ernstp@gmail.com> | 2021-09-27 00:27:19 +0300 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2021-09-30 00:30:00 +0300 |
| commit | 5039f5298880f7a1665d13a24a342d2934d5aa61 (patch) | |
| tree | 2ef7ae68c6248a9948c444c734ca899fb9cb2fa1 /drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | |
| parent | 0069a2273837f199cb93d539a64daeba072a5a2a (diff) | |
| download | linux-5039f5298880f7a1665d13a24a342d2934d5aa61.tar.xz | |
drm/amd/amdgpu: Validate ip discovery blob
We use the number_instance index that we get from the fw discovery blob
to index into an array for example.
Update error messages (Alex)
Signed-off-by: Ernst Sjöstrand <ernstp@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c')
| -rw-r--r-- | drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c index ada7bc19118a..34173be0749a 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c @@ -245,6 +245,22 @@ void amdgpu_discovery_fini(struct amdgpu_device *adev) adev->mman.discovery_bin = NULL; } +static int amdgpu_discovery_validate_ip(const struct ip *ip) +{ + if (ip->number_instance >= HWIP_MAX_INSTANCE) { + DRM_ERROR("Unexpected number_instance (%d) from ip discovery blob\n", + ip->number_instance); + return -EINVAL; + } + if (le16_to_cpu(ip->hw_id) >= HW_ID_MAX) { + DRM_ERROR("Unexpected hw_id (%d) from ip discovery blob\n", + le16_to_cpu(ip->hw_id)); + return -EINVAL; + } + + return 0; +} + int amdgpu_discovery_reg_base_init(struct amdgpu_device *adev) { struct binary_header *bhdr; @@ -290,6 +306,10 @@ int amdgpu_discovery_reg_base_init(struct amdgpu_device *adev) for (j = 0; j < num_ips; j++) { ip = (struct ip *)(adev->mman.discovery_bin + ip_offset); + + if (amdgpu_discovery_validate_ip(ip)) + goto next_ip; + num_base_address = ip->num_base_address; DRM_DEBUG("%s(%d) #%d v%d.%d.%d:\n", @@ -321,6 +341,7 @@ int amdgpu_discovery_reg_base_init(struct amdgpu_device *adev) } +next_ip: ip_offset += sizeof(*ip) + 4 * (ip->num_base_address - 1); } } |