[PATCH v5 2/4] drm/amdgpu/aca: Add upper bounds check in aca_bank_hwip_is_matched
Sreeraj S Kurup <[email protected]>
| Newsgroups | gmane.linux.kernel,gmane.comp.freedesktop.amd-gfx,gmane.comp.video.dri.devel |
|---|---|
| Message-ID | <[email protected]> |
In aca_bank_hwip_is_matched(), the 'type' parameter is used directly as an array index into aca_hwid_mcatypes[]. The function previously checked whether 'type' was equal to ACA_HWIP_TYPE_UNKNOW, but did not validate whether 'type' was less than ACA_HWIP_TYPE_COUNT or negative. If an invalid or out-of-bounds enum value is passed, an out-of-bounds memory read occurs on the aca_hwid_mcatypes array. Fix this by validating that 'type' is strictly greater than ACA_HWIP_TYPE_UNKNOW and less than ACA_HWIP_TYPE_COUNT before performing the array lookup. Signed-off-by: Sreeraj S Kurup <[email protected]> --- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c index d0d473082431..c76664af9902 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c @@ -138,7 +138,7 @@ static bool aca_bank_hwip_is_matched(struct aca_bank *bank, enum aca_hwip_type t int hwid, mcatype; u64 ipid; - if (!bank || type == ACA_HWIP_TYPE_UNKNOW) + if (!bank || type <= ACA_HWIP_TYPE_UNKNOW || type >= ACA_HWIP_TYPE_COUNT) return false; hwip = &aca_hwid_mcatypes[type]; -- 2.54.0