From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ed1-f47.google.com (mail-ed1-f47.google.com [209.85.208.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 21A7A35C180 for ; Thu, 30 Jul 2026 17:00:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785430821; cv=none; b=mzw//CRYvUnN+oslG0sjSRKq7jiTEHF/vBy5LrgMhgHjyHMrsWJLpQpvoHtqfFPvhMsxZ7GLseqA2NzVk4ckSJiWW1Wlj+E60fEgYpjNGMSLv6H0BjoR0jRR8cww8vfngJYAyyis9HVqYqMnoW5XeEQggAiXhPdM1Gpd6joJqLc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785430821; c=relaxed/simple; bh=QH9Ak5vcZuVHZgkSsVz61QdSYn3qHda7QAmG+EUw07I=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=E/wZEMzmpSeDAgxnjA/dGpMl+2usTC1iBl1eJlpIZmZwOjEYEHYDGfFwgYwkUOl01PXwcEkKih3jEUrYx0Ra+hjVcmLPC6DFAzl4dzVDksn0UAMN/4EGt2J/kZ0HGbE3tZ4khT7rOnmyX7RnVD4O/u0EeaLFB7bZxmNF+HW9G88= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=GaBc73Ys; arc=none smtp.client-ip=209.85.208.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="GaBc73Ys" Received: by mail-ed1-f47.google.com with SMTP id 4fb4d7f45d1cf-6a07a115571so96799a12.3 for ; Thu, 30 Jul 2026 10:00:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785430818; x=1786035618; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=8afrmJvJNjiQFgHKILdFDrH8vU7XVuTipqlZKwZMuTE=; b=GaBc73Ys9rG5Oy30IpoAOG3Zn+Zo3Dx/PfUXLe4RLgdg9c81Nh/kzY2PbuTIblGzda r8Ig2Zvk1eYtXsoSTbQgK5Vxs4AuXkgL+1O1HL1OAeSdGDlWuzPw0Mo3XsRNmIWKUpOW hNN4SE/QcVx3+dslKD73kff10HqnrsEXsQt0z4EyyPRg5BAD/j/r329JbMFglZ5DcXpN JaSNBZrJWUHkuULO0/FwcLF0xpIgTUrp+lzSP6MBtoZGwqR8tlsZtO9pd6GzkLQluWZm I2x60kJFAiKobzziWeZnB6i4yZIAnEzBuRSjCINZmxxY5+aUcKTVf+fiVIKUPyz+beib ZVLw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785430818; x=1786035618; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=8afrmJvJNjiQFgHKILdFDrH8vU7XVuTipqlZKwZMuTE=; b=S4QUVd/kU2bugjn+M6WHDfseTlcKfTUHXHvtvnAgG/swJsvqzZJb51VjYfhOeKbU1r CAbIQ4gWSYYS18VKR/nKWyAfXJbchjfMgw7FA3PTpXu02S+sAel4U6cx5/g2+0oZ5864 X6NPqKGU4rAxA925KfB0wrODu6suUPlB97ACcku/cPX58JSYaNCvsn2Bo1DWRFrp6y9d uJtBB4d60CWAclR/BH+d/piY5+1WaB1iAg2u8FVytMYdCstCH2bRZF13kkBhEtSV9vf1 aIS8NMZq0lxNnPWeaRVPlmixH6p/Lg0wiqBHpYN8S7nDEAdkWYTYlDnOAgVMwudM8oUz 4Ohw== X-Forwarded-Encrypted: i=1; AHgh+RoXDMzI4KsZp9VfT75DCe8sZlcRBH7HgMbBCaswLnsnXi6hEX7wM2YBHUlCnBvhT3wzv8CL8EpT8mi52OE=@vger.kernel.org X-Gm-Message-State: AOJu0Yw9zhb45DcQ/oYHO6ABHk1NOD5GhgGsvwju+loQgS5DypoTywDY xUcovI23bvj0T83A/RjGK/wXb8eGVtjD8VtSriYMDI4CQycbqny9+iVG X-Gm-Gg: AR+sD11K7GEOH/JrjQ0Jjpm9tjinvhyLNnYuliaI1yqEeSCLprBYRBfRYGdh+y6yAzi o0ML28RvLSR/zxy3NDK5nlyx0Zo383kKCT8f1V8JqiGPoH61A9kJoNUBwx8YqKum8OjD/WiZ3Ya ATnGN4KhS7YslvYTpaix9POonou/GaOk5lg0rnuPyIdtkgvZFI65sL4Zg+Wm5RbAtgZhizrpfjs k8z7wMKK4S50KrcatziSmUvgslOUXVh+eCbT3SpXCwy2WFP8UT9tAyJrdge0VQIX9pmL6OTZsY/ ClxJDzk9zf5OyfD7stabt7aN0G6sj9z3asBPmilypF7C/IC+tVAZhRoRyy13myv6UYBK/CMuTvU pLU0umU4nqRno11ESRWSXFyHytRETQlmssTvxBZ6TO48vFhpHgnVKAunAeVildlKYr9WHWBhsXm IQ0Et125LR+1wWFhchAliLFjtvMRFPFSjLFyxWPov2P9pdKaLVPZPi8pgcNs54xkLjvv4CheWeg wtanBdCRBtk6GziibvKweEP5de2fcDZnutSf4651mu0iQryakir X-Received: by 2002:a17:907:3e84:b0:c16:66dc:3abe with SMTP id a640c23a62f3a-c1fa54e8f31mr174712266b.28.1785430817965; Thu, 30 Jul 2026 10:00:17 -0700 (PDT) Received: from misharu.home (2a02-a463-a071-0-ee66-8497-94b5-6e78.fixed6.kpn.net. [2a02:a463:a071:0:ee66:8497:94b5:6e78]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c1fa851d4b7sm93725366b.4.2026.07.30.10.00.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 30 Jul 2026 10:00:17 -0700 (PDT) From: Hari Mishal To: Alex Deucher Cc: =?UTF-8?q?Christian=20K=C3=B6nig?= , David Airlie , Simona Vetter , Lijo Lazar , Hawking Zhang , Mario Limonciello , Tao Zhou , Kees Cook , Candice Li , Jammy Zhou , amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Greg Kroah-Hartman , Hari Mishal Subject: [PATCH] drm/amdgpu: bound ATOM bytecode cursor within the VBIOS image Date: Thu, 30 Jul 2026 19:00:11 +0200 Message-ID: <20260730170011.28915-1-harimishal1@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The ATOM interpreter executes bytecode straight out of the VBIOS image and multiple cursor-mutation paths are not bounded against the image size: - the main opcode fetch loop follows jump/skip targets anywhere (jump targets are u16 offsets that can point past a small image), - atom_op_switch scans for ATOM_CASE_END with no limit; a table that omits the marker walks off the allocated BIOS copy, - atom_op_processds advances the cursor by an unchecked u16 taken from the table itself, - the command-table base offset from the master table is used unchecked before its header fields are read. On a malformed/malicious VBIOS image, these reads could run past the kmalloc'd BIOS buffer and the out-of-bounds bytes get interpreted as further opcodes/operands. atom_context::bios_size and the corresponding amdgpu_atom_parse() parameter already exist in this tree; this uses that existing infrastructure to bound the four sites above. atom_index_iio() is already bounds-checked separately and is not touched here. Assisted-by: gkh_clanker:t1000 Signed-off-by: Hari Mishal --- drivers/gpu/drm/amd/amdgpu/atom.c | 29 +++++++++++++++++++++++++++-- 1 file changed, 27 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c b/drivers/gpu/drm/amd/amdgpu/atom.c index e0e585f280e2..56c8a17edea1 100644 --- a/drivers/gpu/drm/amd/amdgpu/atom.c +++ b/drivers/gpu/drm/amd/amdgpu/atom.c @@ -1032,8 +1032,12 @@ static void atom_op_switch(atom_exec_context *ctx, int *ptr, int arg) uint32_t src, val, target; SDEBUG(" switch: "); src = atom_get_src(ctx, attr, ptr); - while (U16(*ptr) != ATOM_CASE_END) + while ((uint32_t)*ptr + 2 <= ctx->ctx->bios_size && + U16(*ptr) != ATOM_CASE_END) if (U8(*ptr) == ATOM_CASE_MAGIC) { + /* magic byte + immediate (up to 4) + 2-byte target */ + if ((uint32_t)*ptr + 7 > ctx->ctx->bios_size) + break; (*ptr)++; SDEBUG(" case: "); val = @@ -1087,7 +1091,14 @@ static void atom_op_debug(atom_exec_context *ctx, int *ptr, int arg) static void atom_op_processds(atom_exec_context *ctx, int *ptr, int arg) { - uint16_t val = U16(*ptr); + u16 val; + + /* the skip count is bytecode-supplied; validate before reading it */ + if ((uint32_t)*ptr + 2 > ctx->ctx->bios_size) { + ctx->abort = true; + return; + } + val = U16(*ptr); (*ptr) += val + 2; SDEBUG("PROCESSDS output: 0x%02X\n", val); } @@ -1237,6 +1248,13 @@ static int amdgpu_atom_execute_table_locked(struct atom_context *ctx, int index, if (!base) return -EINVAL; + /* the table offset itself comes from the VBIOS master table */ + if ((uint32_t)base + ATOM_CT_CODE_PTR >= ctx->bios_size) { + DRM_ERROR("atombios command table %d offset 0x%x outside VBIOS image\n", + index, base); + return -EINVAL; + } + if (ctx->execute_depth >= ATOM_EXECUTE_MAX_DEPTH) { DRM_ERROR("atombios command table nesting exceeded limit (%u)\n", ATOM_EXECUTE_MAX_DEPTH); @@ -1273,6 +1291,13 @@ static int amdgpu_atom_execute_table_locked(struct atom_context *ctx, int index, debug_depth++; while (1) { + /* jump/skip targets are bytecode-supplied; stay inside the image */ + if ((uint32_t)ptr >= ctx->bios_size) { + DRM_ERROR("atombios cursor 0x%x outside VBIOS image (table %04X)\n", + ptr, base); + ret = -EINVAL; + goto free; + } op = CU8(ptr++); if (op < ATOM_OP_NAMES_CNT) SDEBUG("%s @ 0x%04X\n", atom_op_names[op], ptr - 1); -- 2.43.0