[SRU] [R] [PATCH 08/13] drm/amdgpu: Add size guard before copy discovery binary

[Yo-Jung Leo Lin (AMD)]

From: Feifei Xu <Feifei.Xu at amd.com>

BugLink: https://bugs.launchpad.net/bugs/2158690

Fix the firmware blob copied into fixed-size buffer without length check.

Signed-off-by: Feifei Xu <Feifei.Xu at amd.com>
Reviewed-by: Le Ma <le.ma at amd.com>
Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
(cherry picked from commit 5ac01ec854079ac95733ac9a8f3eb694bbe8ff5a)
Signed-off-by: Yo-Jung Leo Lin (AMD) <Leo.Lin at amd.com>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
index fd47ad79d38b..2b3b5bd0d343 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -387,6 +387,26 @@ static int amdgpu_discovery_read_binary_from_file(struct amdgpu_device *adev,
 		return r;
 	}
 
+	if (fw->size > adev->discovery.size) {
+		dev_err(adev->dev,
+			"ip discovery firmware \"%s\" too large (%zu > %u)\n",
+			fw_name, fw->size, adev->discovery.size);
+		release_firmware(fw);
+		return -EINVAL;
+	}
+
+	/* Ensure the firmware is at least large enough to contain the
+	 * binary header fields.
+	 */
+	if (fw->size < offsetof(struct binary_header, binary_size) +
+			sizeof(((struct binary_header *)0)->binary_size)) {
+		dev_err(adev->dev,
+			"ip discovery firmware \"%s\" too small (%zu)\n",
+			fw_name, fw->size);
+		release_firmware(fw);
+		return -EINVAL;
+	}
+
 	memcpy((u8 *)binary, (u8 *)fw->data, fw->size);
 	release_firmware(fw);
 
-- 
2.43.0