From 084c8426abae892e03899cee6aa08363fb1f6165 Mon Sep 17 00:00:00 2001 From: Jiang Liu Date: Tue, 15 Apr 2025 15:58:34 +0800 Subject: [PATCH] drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() mainline inclusion from mainline-v6.14-rc3 commit 1abb2648698bf10783d2236a6b4a7ca5e8021699 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC78 CVE: CVE-2025-21780 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1abb2648698bf10783d2236a6b4a7ca5e8021699 -------------------------------- It malicious user provides a small pptable through sysfs and then a bigger pptable, it may cause buffer overflow attack in function smu_sys_set_pp_table(). Reviewed-by: Lijo Lazar Signed-off-by: Jiang Liu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org Conflicts: drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c [The smu->mutex in the context has not been removed.] Signed-off-by: Wang Zhaolong --- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c index ee27970cfff9..98c9ac875daa 100644 --- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c @@ -327,8 +327,10 @@ int smu_sys_set_pp_table(struct smu_context *smu, void *buf, size_t size) } mutex_lock(&smu->mutex); - if (!smu_table->hardcode_pptable) + if (!smu_table->hardcode_pptable || smu_table->power_play_table_size < size) { + kfree(smu_table->hardcode_pptable); smu_table->hardcode_pptable = kzalloc(size, GFP_KERNEL); + } if (!smu_table->hardcode_pptable) { ret = -ENOMEM; goto failed; -- Gitee