Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
drm/amdgpu: Fix FRU data checking
Ensure that when we memcpy, we don't end up copying more data than
the struct supports. For now, this is 16 characters for product number
and serial number, and 32 chars for product name
Signed-off-by: Kent Russell <kent.russell@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
authored by
Kent Russell
and committed by
Alex Deucher
714309f0
358e00e0
+21
+21
drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c
+21
drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c
···
116
116
return size;
117
117
}
118
118
119
+
/* Product name should only be 32 characters. Any more,
120
+
* and something could be wrong. Cap it at 32 to be safe
121
+
*/
122
+
if (size > 32) {
123
+
DRM_WARN("FRU Product Number is larger than 32 characters. This is likely a mistake");
124
+
size = 32;
125
+
}
119
126
/* Start at 2 due to buff using fields 0 and 1 for the address */
120
127
memcpy(adev->product_name, &buff[2], size);
121
128
adev->product_name[size] = '\0';
···
134
127
return size;
135
128
}
136
129
130
+
/* Product number should only be 16 characters. Any more,
131
+
* and something could be wrong. Cap it at 16 to be safe
132
+
*/
133
+
if (size > 16) {
134
+
DRM_WARN("FRU Product Number is larger than 16 characters. This is likely a mistake");
135
+
size = 16;
136
+
}
137
137
memcpy(adev->product_number, &buff[2], size);
138
138
adev->product_number[size] = '\0';
139
139
···
160
146
return size;
161
147
}
162
148
149
+
/* Serial number should only be 16 characters. Any more,
150
+
* and something could be wrong. Cap it at 16 to be safe
151
+
*/
152
+
if (size > 16) {
153
+
DRM_WARN("FRU Serial Number is larger than 16 characters. This is likely a mistake");
154
+
size = 16;
155
+
}
163
156
memcpy(adev->serial, &buff[2], size);
164
157
adev->serial[size] = '\0';
165
158