Unverified Commit 0a813b20 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!13274 CVE-2024-50117 

Merge Pull Request from: @ci-robot 
 
PR sync from: Xia Fukun <xiafukun@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/EA2DKM2CDKKT4UPLMTS4LNBS6XU4XPKO/ 
CVE-2024-50117 patch:

Antonio Quartulli (1):
  drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported

Mario Limonciello (1):
  drm/amd: Guard against bad data for ATIF ACPI method


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/IB2BX5 
 
Link:https://gitee.com/openeuler/kernel/pulls/13274

 

Reviewed-by: default avatarZucheng Zheng <zhengzucheng@huawei.com>
Reviewed-by: default avatarYuan Can <yuancan@huawei.com>
Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
parents 4c37b644 7c1bd64a

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c

+13 −4
Original line number Diff line number Diff line
@@ -90,6 +90,7 @@ static union acpi_object *amdgpu_atif_call(struct amdgpu_atif *atif, 
					   struct acpi_buffer *params)

{

	acpi_status status;

	union acpi_object *obj;

	union acpi_object atif_arg_elements[2];

	struct acpi_object_list atif_arg;

	struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
@@ -112,16 +113,24 @@ static union acpi_object *amdgpu_atif_call(struct amdgpu_atif *atif, 


	status = acpi_evaluate_object(atif->handle, NULL, &atif_arg,

				      &buffer);

	obj = (union acpi_object *)buffer.pointer;



	/* Fail only if calling the method fails and ATIF is supported */

	if (ACPI_FAILURE(status) && status != AE_NOT_FOUND) {

	/* Fail if calling the method fails */

	if (ACPI_FAILURE(status)) {

		DRM_DEBUG_DRIVER("failed to evaluate ATIF got %s\n",

				 acpi_format_exception(status));

		kfree(buffer.pointer);

		kfree(obj);

		return NULL;

	}



	return buffer.pointer;

	if (obj->type != ACPI_TYPE_BUFFER) {

		DRM_DEBUG_DRIVER("bad object returned from ATIF: %d\n",

				 obj->type);

		kfree(obj);

		return NULL;

	}



	return obj;

}



/**