Re: [PATCH] drm/amdgpu/atom: do not dereference NULL vbios string pointer

[Krzysztof Kozlowski <krzk@kernel.org>]

On 11/11/2026 17:57, Alex Deucher wrote:
> On Mon, Nov 9, 2026 at 4:41 AM Noah Weinberger
> <NoahWeinberger2003@proton.me> wrote:
>>
>> Hello,
>>
>> In atom_get_vbios_pn(), when the part-number string is empty and
>> atom_find_str_in_rom() cannot find the ATOMBIOS anchor, the fallback
>> computes NULL + sizeof(BIOS_ATOM_PREFIX) - 1, i.e. (unsigned char *)8:
>>
>>     vbios_str = atom_find_str_in_rom(ctx, BIOS_ATOM_PREFIX, 3, 1024, 64);
>>     if (vbios_str == NULL)
>>             vbios_str += sizeof(BIOS_ATOM_PREFIX) - 1;
>>
>> The subsequent range check is false for a near-NULL pointer, so the
>> value survives and *vbios_str dereferences address 8 - a NULL-page oops
>> during probe with a malformed VBIOS that passes the magic checks. The
>> recent hardening of the neighboring date/version/build helpers closed
>> their OOB reads; this fallback path was left intact.
>>
>> Simply leave the part number empty when the anchor is not found.
>>
>> Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), drivers/gpu/drm/amd/amdgpu/atom.c:1491-1503 (atom_get_vbios_pn).
>> Pointer-arithmetic-on-NULL is pre-existing; this window's hardening series made it the sole fallback outcome.
>>
>> This was found during an assisted (AI-supported) static source review of
>> mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every code path cited below was re-verified by the
>> reporter against that tree. The patch below has NOT been compiled and has
>> NOT been runtime tested, and no reproducer was produced - the triggering
>> conditions are described above instead. Please treat this as a report for
>> verification rather than a battle-tested fix.
>>
>> Reported-by: Noah Weinberger <noahweinberger2003@proton.me>
> 
> Missing your Signed-off-by.

That is not a patch, but a report. It wasn't tested, wasn't even
verified and is possible that it is LLM slop like the rest.

Best regards,
Krzysztof