Commit 550a4e07 authored by David Miller's avatar David Miller Committed by Luis Henriques

radeon: Do not directly dereference pointers to BIOS area.

commit f2c9e560 upstream.

Use readb() and memcpy_fromio() accessors instead.
Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
parent 00092107
...@@ -76,7 +76,7 @@ static bool igp_read_bios_from_vram(struct radeon_device *rdev) ...@@ -76,7 +76,7 @@ static bool igp_read_bios_from_vram(struct radeon_device *rdev)
static bool radeon_read_bios(struct radeon_device *rdev) static bool radeon_read_bios(struct radeon_device *rdev)
{ {
uint8_t __iomem *bios; uint8_t __iomem *bios, val1, val2;
size_t size; size_t size;
rdev->bios = NULL; rdev->bios = NULL;
...@@ -86,15 +86,19 @@ static bool radeon_read_bios(struct radeon_device *rdev) ...@@ -86,15 +86,19 @@ static bool radeon_read_bios(struct radeon_device *rdev)
return false; return false;
} }
if (size == 0 || bios[0] != 0x55 || bios[1] != 0xaa) { val1 = readb(&bios[0]);
val2 = readb(&bios[1]);
if (size == 0 || val1 != 0x55 || val2 != 0xaa) {
pci_unmap_rom(rdev->pdev, bios); pci_unmap_rom(rdev->pdev, bios);
return false; return false;
} }
rdev->bios = kmemdup(bios, size, GFP_KERNEL); rdev->bios = kzalloc(size, GFP_KERNEL);
if (rdev->bios == NULL) { if (rdev->bios == NULL) {
pci_unmap_rom(rdev->pdev, bios); pci_unmap_rom(rdev->pdev, bios);
return false; return false;
} }
memcpy_fromio(rdev->bios, bios, size);
pci_unmap_rom(rdev->pdev, bios); pci_unmap_rom(rdev->pdev, bios);
return true; return true;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment