Re: [PATCH] drm/radeon: validate ATRM return buffer type and length

[Alex Deucher]

Reviewed and applied.  Thanks!

On Fri, Oct 30, 2026 at 5:13 AM Tristan Madani <tristmd@xxxxxxxxx> wrote:
>
> From: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
>
> radeon_atrm_call() copies the ACPI ATRM method return data without
> checking that the returned object is actually a buffer or that its
> length fits within the caller-provided size.  If the ATRM method
> returns a non-buffer object type or an oversized buffer, the memcpy
> writes past the destination bounds.
>
> Add a NULL pointer check and ACPI_TYPE_BUFFER type validation before
> accessing the buffer fields, and clamp the copy length to the
> requested size.  This matches the validation already present in the
> amdgpu counterpart amdgpu_atrm_call().
>
> Fixes: c61e2775873f ("drm/radeon: split ATRM support out from the ATPX handler (v3)")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
> ---
>  drivers/gpu/drm/radeon/radeon_bios.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
> index 1da6bf1c17ff3..579ba1c1f23a4 100644
> --- a/drivers/gpu/drm/radeon/radeon_bios.c
> +++ b/drivers/gpu/drm/radeon/radeon_bios.c
> @@ -183,8 +183,13 @@ static int radeon_atrm_call(acpi_handle atrm_handle, uint8_t *bios,
>         }
>
>         obj = (union acpi_object *)buffer.pointer;
> -       memcpy(bios+offset, obj->buffer.pointer, obj->buffer.length);
> -       len = obj->buffer.length;
> +       if (!obj || obj->type != ACPI_TYPE_BUFFER) {
> +               kfree(buffer.pointer);
> +               return -EINVAL;
> +       }
> +
> +       len = min_t(size_t, obj->buffer.length, len);
> +       memcpy(bios + offset, obj->buffer.pointer, len);
>         kfree(buffer.pointer);
>         return len;
>  }
> --
> 2.47.3
>