atom_get_src_int() and atom_put_dst() use idx as a dword index into the uint32_t *ps array (ctx->ps[idx]), but compare it against ctx->ps_size which is in bytes. A malformed ATOM table operand with idx between ps_size/4 and ps_size-1 passes the bounds check but accesses up to 3 dwords (12 bytes) beyond the stack-allocated parameter buffer. For example with ps_size = 16 bytes (4 dwords), idx = 5 passes the check (5 < 16) but ctx->ps[5] reads/writes the 6th dword at byte offset 20, 4 bytes past the allocation. Divide ps_size by 4 in both comparisons to match the dword indexing. Fixes: d38ceaf99ed0 ("drm/amdgpu: add coordinate ATOMBIOS table support") Cc: stable@vger.kernel.org Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260923163157.1354872-1-qwe.aldo@gmail.com?part=1 Signed-off-by: Aldo Ariel Panzardo --- drivers/gpu/drm/amd/amdgpu/atom.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c b/drivers/gpu/drm/amd/amdgpu/atom.c index e0e585f..d0a45f6 100644 --- a/drivers/gpu/drm/amd/amdgpu/atom.c +++ b/drivers/gpu/drm/amd/amdgpu/atom.c @@ -232,7 +232,7 @@ static uint32_t atom_get_src_int(atom_exec_context *ctx, uint8_t attr, (*ptr)++; /* get_unaligned_le32 avoids unaligned accesses from atombios * tables, noticed on a DEC Alpha. */ - if (idx < ctx->ps_size) + if (idx < ctx->ps_size / 4) val = get_unaligned_le32((u32 *)&ctx->ps[idx]); else pr_info("PS index out of range: %i > %i\n", idx, ctx->ps_size); @@ -510,7 +510,7 @@ static void atom_put_dst(atom_exec_context *ctx, int arg, uint8_t attr, idx = U8(*ptr); (*ptr)++; DEBUG("PS[0x%02X]", idx); - if (idx >= ctx->ps_size) { + if (idx >= ctx->ps_size / 4) { pr_info("PS index out of range: %i > %i\n", idx, ctx->ps_size); return; } -- 2.43.0