DragonFlyBSD Kernel Audit
DF-1245 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/drm/radeon/evergreen_cs.c b/sys/dev/drm/radeon/evergreen_cs.c
--- a/sys/dev/drm/radeon/evergreen_cs.c
+++ b/sys/dev/drm/radeon/evergreen_cs.c
@@ -401,6 +401,11 @@
 	pitch = track->cb_color_pitch[id];
 	slice = track->cb_color_slice[id];
 	surf.nbx = (pitch + 1) * 8;
+	if (surf.nbx == 0) {
+		dev_warn(p->dev, "%s:%d cb color %d pitch 0x%08x causes zero nbx\n",
+			 __func__, __LINE__, id, pitch);
+		return -EINVAL;
+	}
 	surf.nby = ((slice + 1) * 64) / surf.nbx;
 	surf.mode = G_028C70_ARRAY_MODE(track->cb_color_info[id]);
 	surf.format = G_028C70_FORMAT(track->cb_color_info[id]);