drm/amdgpu: Add checks to vbios fetch through ATRM

Check if a valid buffer object is returned after ATRM call. Also, match
the buffer length against requested size before copying.

Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
index aa039e148a5ee795fa5635b6c684691c64a5e80c..3ebdd792feec1f8bc81e999403378fe26b3c6a00 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
@@ -296,8 +296,14 @@ static int amdgpu_atrm_call(acpi_handle atrm_handle, uint8_t *bios,
        }
 
        obj = (union acpi_object *)buffer.pointer;
-       memcpy(bios+offset, obj->buffer.pointer, obj->buffer.length);
-       len = obj->buffer.length;
+       if (!obj || obj->type != ACPI_TYPE_BUFFER) {
+               DRM_ERROR("ATRM returned an invalid object\n");
+               kfree(buffer.pointer);
+               return -EINVAL;
+       }
+
+       len = min_t(size_t, obj->buffer.length, len);
+       memcpy(bios+offset, obj->buffer.pointer, len);
        kfree(buffer.pointer);
        return len;
 }