⬢ DragonFlyBSD Kernel Audit
DF-1342 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
diff --git a/sys/dev/drm/radeon/r600_cs.c b/sys/dev/drm/radeon/r600_cs.c
--- a/sys/dev/drm/radeon/r600_cs.c
+++ b/sys/dev/drm/radeon/r600_cs.c
@@ -2404,6 +2404,10 @@
 				DRM_ERROR("bad DMA_PACKET_WRITE\n");
 				return -EINVAL;
 			}
+			if (idx + 2 >= ib_chunk->length_dw) {
+				DRM_ERROR("DMA_PACKET_WRITE not enough IB space at %d !\n", idx);
+				return -EINVAL;
+			}
 			if (tiled) {
 				dst_offset = radeon_get_ib_value(p, idx+1);
 				dst_offset <<= 8;
@@ -2436,6 +2440,10 @@
 				return -EINVAL;
 			}
 			if (tiled) {
+				if (idx + 6 >= ib_chunk->length_dw) {
+					DRM_ERROR("DMA_PACKET_COPY tiled not enough IB space at %d !\n", idx);
+					return -EINVAL;
+				}
 				idx_value = radeon_get_ib_value(p, idx + 2);
 				/* detile bit */
 				if (idx_value & (1 << 31)) {
@@ -2461,6 +2469,10 @@
 				}
 				p->idx += 7;
 			} else {
+				if (idx + 4 >= ib_chunk->length_dw) {
+					DRM_ERROR("DMA_PACKET_COPY not enough IB space at %d !\n", idx);
+					return -EINVAL;
+				}
 				if (p->family >= CHIP_RV770) {
 					src_offset = radeon_get_ib_value(p, idx+2);
 					src_offset |= ((u64)(radeon_get_ib_value(p, idx+4) & 0xff)) << 32;
@@ -2506,6 +2518,10 @@
 				DRM_ERROR("bad DMA_PACKET_WRITE\n");
 				return -EINVAL;
 			}
+			if (idx + 3 >= ib_chunk->length_dw) {
+				DRM_ERROR("DMA_PACKET_CONSTANT_FILL not enough IB space at %d !\n", idx);
+				return -EINVAL;
+			}
 			dst_offset = radeon_get_ib_value(p, idx+1);
 			dst_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0x00ff0000)) << 16;
 			if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {