drm/amdgpu: cap ATOM command table nesting depth

Cap nesting at 32 levels with execute_depth and
return -ELOOP when exceeded.

Signed-off-by: Candice Li <candice.li@amd.com>
Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c b/drivers/gpu/drm/amd/amdgpu/atom.c
index 6e37961f6be53b37f9a3dac450650b771c3745bb..ca5d091549e1f227cb4e3107d352f4b65a49eab3 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/atom.c
+++ b/drivers/gpu/drm/amd/amdgpu/atom.c
@@ -59,6 +59,9 @@
 
 #define ATOM_CMD_TIMEOUT_SEC   20
 
+/* Limit ATOM command table recursion (calltable) to avoid kernel stack overflow. */
+#define ATOM_EXECUTE_MAX_DEPTH 32
+
 typedef struct {
        struct atom_context *ctx;
        uint32_t *ps, *ws;
@@ -1229,6 +1232,13 @@ static int amdgpu_atom_execute_table_locked(struct atom_context *ctx, int index,
        if (!base)
                return -EINVAL;
 
+       if (ctx->execute_depth >= ATOM_EXECUTE_MAX_DEPTH) {
+               DRM_ERROR("atombios command table nesting exceeded limit (%u)\n",
+                         ATOM_EXECUTE_MAX_DEPTH);
+               return -ELOOP;
+       }
+       ctx->execute_depth++;
+
        len = CU16(base + ATOM_CT_SIZE_PTR);
        ws = CU8(base + ATOM_CT_WS_PTR);
        ps = CU8(base + ATOM_CT_PS_PTR) & ATOM_CT_PS_MASK;
@@ -1285,6 +1295,7 @@ static int amdgpu_atom_execute_table_locked(struct atom_context *ctx, int index,
 free:
        if (ws)
                kfree(ectx.ws);
+       ctx->execute_depth--;
        return ret;
 }
 

diff --git a/drivers/gpu/drm/amd/amdgpu/atom.h b/drivers/gpu/drm/amd/amdgpu/atom.h
index 825ff28731f52d99b2eb283b925a882f3ac40f82..bb3d9eb7eb6b56ef21120050cd5cd554938ac784 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/atom.h
+++ b/drivers/gpu/drm/amd/amdgpu/atom.h
@@ -153,6 +153,9 @@ struct atom_context {
        uint8_t vbios_ver_str[STRLEN_NORMAL];
        uint8_t date[STRLEN_NORMAL];
        uint8_t build_num[STRLEN_NORMAL];
+
+       /* Nesting depth for ATOM_OP_CALLTABLE */
+       unsigned int execute_depth;
 };
 
 extern int amdgpu_atom_debug;