From: Shiwu Zhang <shiwu.zhang@amd.com>
Date: Wed, 13 May 2026 05:54:58 +0000 (+0800)
Subject: drm/amdgpu: fix buffer overflow during vBIOS update
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6229898d46c0cbc238a6fe9f11c1ea12cf8bb9c5;p=thirdparty%2Flinux.git

drm/amdgpu: fix buffer overflow during vBIOS update

Clamp the buffer postion to write by setting the bin attribute
to the maximum buffer size so that VFS layer will block the
out-of-bounds accessing.

Signed-off-by: Shiwu Zhang <shiwu.zhang@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
---

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
index 665a2632379de..e3210ce171837 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
@@ -4723,7 +4723,7 @@ rel_buf:
  */
 static const struct bin_attribute psp_vbflash_bin_attr = {
 	.attr = {.name = "psp_vbflash", .mode = 0660},
-	.size = 0,
+	.size = AMD_VBIOS_FILE_MAX_SIZE_B,
 	.write = amdgpu_psp_vbflash_write,
 	.read = amdgpu_psp_vbflash_read,
 };