DragonFlyBSD Kernel Audit
DF-1042 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/platform/pc64/apic/lapic.c b/sys/platform/pc64/apic/lapic.c
--- a/sys/platform/pc64/apic/lapic.c
+++ b/sys/platform/pc64/apic/lapic.c
@@ -1212,6 +1212,12 @@
 void
 lapic_set_cpuid(int cpu_id, int apic_id)
 {
+	if (cpu_id < 0 || cpu_id >= NAPICID ||
+	    apic_id < 0 || apic_id >= NAPICID) {
+		kprintf("lapic_set_cpuid: invalid cpu_id %d apic_id %d, skipping\n",
+		    cpu_id, apic_id);
+		return;
+	}
 	CPUID_TO_APICID(cpu_id) = apic_id;
 	APICID_TO_CPUID(apic_id) = cpu_id;
 }
diff --git a/sys/platform/pc64/acpica/acpi_madt.c b/sys/platform/pc64/acpica/acpi_madt.c
--- a/sys/platform/pc64/acpica/acpi_madt.c
+++ b/sys/platform/pc64/acpica/acpi_madt.c
@@ -311,6 +311,8 @@
 			kprintf("cpu id %d, WARNING acpi processorid %d\n",
 				cpu, lapic_ent->ProcessorId);
 		}
+		if (cpu >= MAXCPU)
+			return 0;
 		lapic_set_cpuid(cpu, lapic_ent->Id);
 		CPUID_TO_ACPIID(cpu) = lapic_ent->ProcessorId;
 	}
@@ -339,6 +341,8 @@
 		}
 		MADT_VPRINTF("cpu id %d, acpi uid %u, apic id %d\n",
 		    cpu, x2apic_ent->Uid, x2apic_ent->LocalApicId);
+		if (cpu >= MAXCPU || x2apic_ent->LocalApicId >= APICID_MAX)
+			return 0;
 		lapic_set_cpuid(cpu, x2apic_ent->LocalApicId);
 		CPUID_TO_ACPIID(cpu) = x2apic_ent->Uid;
 	}