Re: [PATCH] drm/radeon: reject invalid ATRM results

[Alex Deucher]

On Tue, Nov 3, 2026 at 9:21 AM Kang Chen <k.chen@xxxxxxxxxxxxxxxx> wrote:
>
> radeon_atrm_call() trusts the buffer returned by the ATRM method: it
> copies obj->buffer.length bytes into the VBIOS image without checking
> the object type or that the length fits in the requested chunk.  A
> firmware-provided ATRM method returning a non-buffer object or a buffer
> larger than the requested 4 KiB chunk can write beyond the 256 KiB
> VBIOS allocation.
>
> Reject the response unless it is an ACPI buffer no larger than the
> requested chunk.  The only caller always requests ATRM_BIOS_PAGE-sized
> chunks inside the VBIOS allocation, so checking the returned length
> against len is sufficient.
>
> Fixes: c61e2775873f ("drm/radeon: split ATRM support out from the ATPX handler (v3)")
> Signed-off-by: Kang Chen <k.chen@xxxxxxxxxxxxxxxx>

Thanks, this was already fixed:
https://patchwork.freedesktop.org/patch/764437/?series=177235&rev=1

Alex

> ---
>  drivers/gpu/drm/radeon/radeon_bios.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
> index 1da6bf1c17ff..c23892470265 100644
> --- a/drivers/gpu/drm/radeon/radeon_bios.c
> +++ b/drivers/gpu/drm/radeon/radeon_bios.c
> @@ -183,7 +183,12 @@ static int radeon_atrm_call(acpi_handle atrm_handle, uint8_t *bios,
>         }
>
>         obj = (union acpi_object *)buffer.pointer;
> -       memcpy(bios+offset, obj->buffer.pointer, obj->buffer.length);
> +       if (!obj || obj->type != ACPI_TYPE_BUFFER || obj->buffer.length > len) {
> +               kfree(buffer.pointer);
> +               return -ENODEV;
> +       }
> +
> +       memcpy(bios + offset, obj->buffer.pointer, obj->buffer.length);
>         len = obj->buffer.length;
>         kfree(buffer.pointer);
>         return len;
> --
> 2.34.1
>