[PATCH] drm/amdgpu: Fix FRU data checking

[Alex Deucher]

On Tue, Mar 24, 2020 at 7:49 AM Kent Russell <kent.russell at amd.com> wrote:
>
> Ensure that when we memcpy, we don't end up copying more data than
> the struct supports. For now, this is 16 characters for product number
> and serial number, and 32 chars for product name
>
> Signed-off-by: Kent Russell <kent.russell at amd.com>

Reviewed-by: Alex Deucher <alexander.deucher at amd.com>

> ---
>  .../gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c    | 21 +++++++++++++++++++
>  1 file changed, 21 insertions(+)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c
> index 6f5e98fda181..bfe4259f9508 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c
> @@ -116,6 +116,13 @@ int amdgpu_fru_get_product_info(struct amdgpu_device *adev)
>                 return size;
>         }
>
> +       /* Product name should only be 32 characters. Any more,
> +        * and something could be wrong. Cap it at 32 to be safe
> +        */
> +       if (size > 32) {
> +               DRM_WARN("FRU Product Number is larger than 32 characters. This is likely a mistake");
> +               size = 32;
> +       }
>         /* Start at 2 due to buff using fields 0 and 1 for the address */
>         memcpy(adev->product_name, &buff[2], size);
>         adev->product_name[size] = '\0';
> @@ -127,6 +134,13 @@ int amdgpu_fru_get_product_info(struct amdgpu_device *adev)
>                 return size;
>         }
>
> +       /* Product number should only be 16 characters. Any more,
> +        * and something could be wrong. Cap it at 16 to be safe
> +        */
> +       if (size > 16) {
> +               DRM_WARN("FRU Product Number is larger than 16 characters. This is likely a mistake");
> +               size = 16;
> +       }
>         memcpy(adev->product_number, &buff[2], size);
>         adev->product_number[size] = '\0';
>
> @@ -146,6 +160,13 @@ int amdgpu_fru_get_product_info(struct amdgpu_device *adev)
>                 return size;
>         }
>
> +       /* Serial number should only be 16 characters. Any more,
> +        * and something could be wrong. Cap it at 16 to be safe
> +        */
> +       if (size > 16) {
> +               DRM_WARN("FRU Serial Number is larger than 16 characters. This is likely a mistake");
> +               size = 16;
> +       }
>         memcpy(adev->serial, &buff[2], size);
>         adev->serial[size] = '\0';
>
> --
> 2.17.1
>
> _______________________________________________
> amd-gfx mailing list
> amd-gfx at lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/amd-gfx