AMD amdgpu: Fix OOB read and zero-size loop in VoltageObjects

Vulnerability Overview Vulnerability Title: Vulnerability Description: During the processing of , there is an issue involving a zero-size loop and an out-of-bounds (OOB) read. This may lead to system crashes or potential security risks. Submitter: Alex Hung Submission Date: 2020-06-10 09:37:04 +0800 Scope of Impact Affected Files: - - Affected Functions: - - Remediation Fix Details: - Added a check for in the and functions to ensure is non-zero, thereby preventing zero-size loops. - Added a check in the loop condition to prevent out-of-bounds reads. POC Code or Exploit Code ```c diff --git a/drivers/gpu/drm/amd/amdgpu/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/amdgpu/powerplay/hwmgr/vega10_hwmgr.c index 18f10302020c..18f10302020c 100644 --- a/drivers/gpu/drm/amd/amdgpu/powerplay/hwmgr/vega10_hwmgr.c +++ b/drivers/gpu/drm/amd/amdgpu/powerplay/hwmgr/vega10_hwmgr.c @@ -20,13 +20,13 @@ static int vega10_get_voltage_object(struct pp_hwmgr hwmgr, uint32_t type, struct vega10_voltage_info_table voltage_info_table; uint32_t offset = 0; uint32_t size; voltage_info_table = (struct vega10_voltage_info_table *)(hwmgr->voltage_info_table); while (offset 0) { const uint32_t table_offset = voltage_info_table->offset; const uint32_t table_size = voltage_info_table->size; const uint32_t table_count = voltage_info_table->count; const uint32_t table_type = voltage_info_table->type; if (table_type == type) { voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_table->type = table_type; voltage_info_table->offset += table_size; voltage_info_table->size -= table_size; voltage_info_table->count--; voltage_info_tabl

Goal Reached Thanks to every supporter — we hit 100%!

AMD amdgpu: Fix OOB read and zero-size loop in VoltageObjects

More from this source