summaryrefslogtreecommitdiff
path: root/include/linux
diff options
context:
space:
mode:
authorHarry Wentland <harry.wentland@amd.com>2026-05-04 16:14:11 -0400
committerAlex Deucher <alexander.deucher@amd.com>2026-05-19 11:45:41 -0400
commitba5e95b43b773ae1bf1f66ee6b31eb774e65afe3 (patch)
treeac73cbb05450bd19b7eaac8e6151a32b7b636404 /include/linux
parentd40fb392af659c4a02b560319f226842f6ec1a95 (diff)
drm/amd/display: Validate GPIO pin LUT table size before iterating
[Why&How] The GPIO pin table parsers in get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() derive an element count from the VBIOS table_header.structuresize field, then iterate over gpio_pin[] entries. However, GET_IMAGE() only validates that the table header itself fits within the BIOS image. If the VBIOS reports a structuresize larger than the actual mapped data, the loop reads past the end of the BIOS image, causing an out-of-bounds read. Fix this by calling bios_get_image() to validate that the full claimed structuresize is accessible within the BIOS image before entering the loop in both functions. Assisted-by: GitHub Copilot:claude-opus-4-6 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'include/linux')
0 files changed, 0 insertions, 0 deletions