⬢ DragonFlyBSD Kernel Audit
DF-1181 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
--- a/sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
+++ b/sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
@@ -657,6 +657,10 @@
 
 		for (entry_id = 0; entry_id < vdt->count; entry_id++) {
 			voltage_id = vdt->entries[entry_id].vddInd;
+			if (voltage_id >= table_info->vddc_lookup_table->count) {
+				pr_err("Invalid VDDC index %u in voltage dependency table %u\n", voltage_id, i);
+				return -EINVAL;
+			}
 			vdt->entries[entry_id].vddc =
 					table_info->vddc_lookup_table->entries[voltage_id].us_vdd;
 		}
@@ -664,18 +668,34 @@
 
 	for (entry_id = 0; entry_id < mm_table->count; ++entry_id) {
 		voltage_id = mm_table->entries[entry_id].vddcInd;
+		if (voltage_id >= table_info->vddc_lookup_table->count) {
+			pr_err("Invalid VDDC index %u in mm dependency table\n", voltage_id);
+			return -EINVAL;
+		}
 		mm_table->entries[entry_id].vddc =
 			table_info->vddc_lookup_table->entries[voltage_id].us_vdd;
 	}
 
 	for (entry_id = 0; entry_id < mclk_table->count; ++entry_id) {
 		voltage_id = mclk_table->entries[entry_id].vddInd;
+		if (voltage_id >= table_info->vddc_lookup_table->count) {
+			pr_err("Invalid VDDC index %u in MCLK dep table\n", voltage_id);
+			return -EINVAL;
+		}
 		mclk_table->entries[entry_id].vddc =
 				table_info->vddc_lookup_table->entries[voltage_id].us_vdd;
 		voltage_id = mclk_table->entries[entry_id].vddciInd;
+		if (voltage_id >= table_info->vddci_lookup_table->count) {
+			pr_err("Invalid VDDCI index %u in MCLK dep table\n", voltage_id);
+			return -EINVAL;
+		}
 		mclk_table->entries[entry_id].vddci =
 				table_info->vddci_lookup_table->entries[voltage_id].us_vdd;
 		voltage_id = mclk_table->entries[entry_id].mvddInd;
+		if (voltage_id >= table_info->vddmem_lookup_table->count) {
+			pr_err("Invalid MVDD index %u in MCLK dep table\n", voltage_id);
+			return -EINVAL;
+		}
 		mclk_table->entries[entry_id].mvdd =
 				table_info->vddmem_lookup_table->entries[voltage_id].us_vdd;
 	}
@@ -1853,6 +1873,12 @@
 
 	for (i = 0; i < dep_table->count; i++) {
 		clk = (uint16_t)(dep_table->entries[i].clk / 100);
+		if (dep_table->entries[i].vddInd >=
+			table_info->vddc_lookup_table->count) {
+			pr_err("Invalid VDDC index %u in display dep table %d\n",
+				dep_table->entries[i].vddInd, disp_clock);
+			return -1;
+		}
 		vddc = table_info->vddc_lookup_table->
 				entries[dep_table->entries[i].vddInd].us_vdd;
 		vid = (uint8_t)convert_to_vid(vddc);
@@ -4245,6 +4271,9 @@
 
 	for (i = 0; i < dep_table->count; i++) {
 		clocks->data[i].clocks_in_khz = dep_table->entries[i].clk  * 10;
+		if (dep_table->entries[i].vddInd >=
+			table_info->vddc_lookup_table->count)
+			return -1;
 		clocks->data[i].voltage_in_mv = (uint32_t)(table_info->vddc_lookup_table->
 				entries[dep_table->entries[i].vddInd].us_vdd);
 		clocks->num_levels++;