drm/amdgpu: fix buffer overflow during vBIOS update

Clamp the buffer postion to write by setting the bin attribute
to the maximum buffer size so that VFS layer will block the
out-of-bounds accessing.

Signed-off-by: Shiwu Zhang <shiwu.zhang@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
index 665a2632379de2d95a37bb0a7e2024d1271ff6c5..e3210ce1718372569cee638ce2550f95227d07e1 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
@@ -4723,7 +4723,7 @@ rel_buf:
  */
 static const struct bin_attribute psp_vbflash_bin_attr = {
        .attr = {.name = "psp_vbflash", .mode = 0660},
-       .size = 0,
+       .size = AMD_VBIOS_FILE_MAX_SIZE_B,
        .write = amdgpu_psp_vbflash_write,
        .read = amdgpu_psp_vbflash_read,
 };