Skip to content

Commit c0ec027

Browse files
committed
drm/amdgpu: Fix the null pointer when load rlc firmware
jira LE-3201 cve CVE-2024-26649 Rebuild_History Non-Buildable kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 commit-author Ma Jun <Jun.Ma2@amd.com> commit 849e133 If the RLC firmware is invalid because of wrong header size, the pointer to the rlc firmware is released in function amdgpu_ucode_request. There will be a null pointer error in subsequent use. So skip validation to fix it. Signed-off-by: Ma Jun <Jun.Ma2@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 849e133) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
1 parent db79970 commit c0ec027

File tree

1 file changed

+6
-9
lines changed

1 file changed

+6
-9
lines changed

drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4003,16 +4003,13 @@ static int gfx_v10_0_init_microcode(struct amdgpu_device *adev)
40034003

40044004
if (!amdgpu_sriov_vf(adev)) {
40054005
snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", ucode_prefix);
4006-
err = amdgpu_ucode_request(adev, &adev->gfx.rlc_fw, fw_name);
4007-
/* don't check this. There are apparently firmwares in the wild with
4008-
* incorrect size in the header
4009-
*/
4010-
if (err == -ENODEV)
4011-
goto out;
4006+
err = request_firmware(&adev->gfx.rlc_fw, fw_name, adev->dev);
40124007
if (err)
4013-
dev_dbg(adev->dev,
4014-
"gfx10: amdgpu_ucode_request() failed \"%s\"\n",
4015-
fw_name);
4008+
goto out;
4009+
4010+
/* don't validate this firmware. There are apparently firmwares
4011+
* in the wild with incorrect size in the header
4012+
*/
40164013
rlc_hdr = (const struct rlc_firmware_header_v2_0 *)adev->gfx.rlc_fw->data;
40174014
version_major = le16_to_cpu(rlc_hdr->header.header_version_major);
40184015
version_minor = le16_to_cpu(rlc_hdr->header.header_version_minor);

0 commit comments

Comments
 (0)