[PATCH] drm/radeon: reject invalid ATRM results

[Kang Chen]

radeon_atrm_call() trusts the buffer returned by the ATRM method: it
copies obj->buffer.length bytes into the VBIOS image without checking
the object type or that the length fits in the requested chunk.  A
firmware-provided ATRM method returning a non-buffer object or a buffer
larger than the requested 4 KiB chunk can write beyond the 256 KiB
VBIOS allocation.

Reject the response unless it is an ACPI buffer no larger than the
requested chunk.  The only caller always requests ATRM_BIOS_PAGE-sized
chunks inside the VBIOS allocation, so checking the returned length
against len is sufficient.

Fixes: c61e2775873f ("drm/radeon: split ATRM support out from the ATPX handler (v3)")
Signed-off-by: Kang Chen <k.chen@xxxxxxxxxxxxxxxx>
---
 drivers/gpu/drm/radeon/radeon_bios.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
index 1da6bf1c17ff..c23892470265 100644
--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -183,7 +183,12 @@ static int radeon_atrm_call(acpi_handle atrm_handle, uint8_t *bios,
 	}
 
 	obj = (union acpi_object *)buffer.pointer;
-	memcpy(bios+offset, obj->buffer.pointer, obj->buffer.length);
+	if (!obj || obj->type != ACPI_TYPE_BUFFER || obj->buffer.length > len) {
+		kfree(buffer.pointer);
+		return -ENODEV;
+	}
+
+	memcpy(bios + offset, obj->buffer.pointer, obj->buffer.length);
 	len = obj->buffer.length;
 	kfree(buffer.pointer);
 	return len;
-- 
2.34.1