atom_get_src_int() and atom_put_dst() use idx as a dword index into the uint32_t *ps array (ctx->ps[idx]), but compare it against ctx->ps_size which is in bytes. A malformed ATOM table operand with idx between ps_size/4 and ps_size-1 passes the bounds check but accesses up to 3 dwords (12 bytes) beyond the stack-allocated parameter buffer. For example with ps_size = 16 bytes (4 dwords), idx = 5 passes the check (5 < 16) but ctx->ps[5] reads/writes the 6th dword at byte offset 20, 4 bytes past the allocation. Divide ps_size by 4 in both comparisons and in the diagnostic messages to match the dword indexing. Fixes: d38ceaf99ed0 ("drm/amdgpu: add coordinate ATOMBIOS table support") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Aldo Ariel Panzardo --- v2: also fix the pr_info() messages to print ps_size/4 (dwords) instead of ps_size (bytes), so the logged limit matches the actual check (found by Sashiko AI review). drivers/gpu/drm/amd/amdgpu/atom.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c b/drivers/gpu/drm/amd/amdgpu/atom.c index e0e585f..dd6c22a 100644 --- a/drivers/gpu/drm/amd/amdgpu/atom.c +++ b/drivers/gpu/drm/amd/amdgpu/atom.c @@ -232,10 +232,10 @@ static uint32_t atom_get_src_int(atom_exec_context *ctx, uint8_t attr, (*ptr)++; /* get_unaligned_le32 avoids unaligned accesses from atombios * tables, noticed on a DEC Alpha. */ - if (idx < ctx->ps_size) + if (idx < ctx->ps_size / 4) val = get_unaligned_le32((u32 *)&ctx->ps[idx]); else - pr_info("PS index out of range: %i > %i\n", idx, ctx->ps_size); + pr_info("PS index out of range: %i >= %i\n", idx, ctx->ps_size / 4); if (print) DEBUG("PS[0x%02X,0x%04X]", idx, val); break; @@ -510,8 +510,8 @@ static void atom_put_dst(atom_exec_context *ctx, int arg, uint8_t attr, idx = U8(*ptr); (*ptr)++; DEBUG("PS[0x%02X]", idx); - if (idx >= ctx->ps_size) { - pr_info("PS index out of range: %i > %i\n", idx, ctx->ps_size); + if (idx >= ctx->ps_size / 4) { + pr_info("PS index out of range: %i >= %i\n", idx, ctx->ps_size / 4); return; } ctx->ps[idx] = cpu_to_le32(val); -- 2.43.0