]> git.ipfire.org Git - thirdparty/linux.git/commit
drm/amd/pm: bound pp_dpm_set_pp_table() memcpy
authorAsad Kamal <asad.kamal@amd.com>
Tue, 12 May 2026 07:44:32 +0000 (15:44 +0800)
committerAlex Deucher <alexander.deucher@amd.com>
Wed, 3 Jun 2026 17:52:44 +0000 (13:52 -0400)
commitf193e71fa9fab2e68ef85201b106e8f580d3a25b
treee25085235517cdabd0c108a820a0f7c30f40bc64
parent2064610469c5f7f5d665034ddd4c4365dff65f58
drm/amd/pm: bound pp_dpm_set_pp_table() memcpy

The powerplay path allocates hardcode_pp_table once with kmemdup(...,
soft_pp_table_size). memcpy(..., size) used the sysfs store count (up to
PAGE_SIZE) with no upper bound, causing heap overflow. Reject
writes where size exceeds soft_pp_table_size.

Signed-off-by: Asad Kamal <asad.kamal@amd.com>
Reviewed-by: Yang Wang <kevinyang.wang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c