iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

drm/amd/amdgpu: Validate ip discovery blob

Browse Source 
We use the number_instance index that we get from the fw discovery blob
to index into an array for example.

Update error messages (Alex)

Signed-off-by: Ernst Sjöstrand <ernstp@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
Ernst Sjöstrand 2021-09-26 23:27:19 +02:00 committed by Alex Deucher
parent 0069a22738
commit 5039f52988
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
View File

@ -245,6 +245,22 @@ void amdgpu_discovery_fini(struct amdgpu_device *adev)
adev->mman.discovery_bin = NULL;
}
static int amdgpu_discovery_validate_ip(const struct ip *ip)
{
if (ip->number_instance >= HWIP_MAX_INSTANCE) {
DRM_ERROR("Unexpected number_instance (%d) from ip discovery blob\n",
ip->number_instance);
return -EINVAL;
}
if (le16_to_cpu(ip->hw_id) >= HW_ID_MAX) {
DRM_ERROR("Unexpected hw_id (%d) from ip discovery blob\n",
le16_to_cpu(ip->hw_id));
return -EINVAL;
}
return 0;
}
int amdgpu_discovery_reg_base_init(struct amdgpu_device *adev)
{
struct binary_header *bhdr;
@ -290,6 +306,10 @@ int amdgpu_discovery_reg_base_init(struct amdgpu_device *adev)
for (j = 0; j < num_ips; j++) {
ip = (struct ip *)(adev->mman.discovery_bin + ip_offset);
if (amdgpu_discovery_validate_ip(ip))
goto next_ip;
num_base_address = ip->num_base_address;
DRM_DEBUG("%s(%d) #%d v%d.%d.%d:\n",
@ -321,6 +341,7 @@ int amdgpu_discovery_reg_base_init(struct amdgpu_device *adev)
}
next_ip:
ip_offset += sizeof(*ip) + 4 * (ip->num_base_address - 1);
}
}