⬢ DragonFlyBSD Kernel Audit
DF-1536 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
diff --git a/sys/dev/drm/radeon/atom.c b/sys/dev/drm/radeon/atom.c
--- a/sys/dev/drm/radeon/atom.c
+++ b/sys/dev/drm/radeon/atom.c
@@ -60,6 +60,7 @@
 	unsigned last_jump;
 	unsigned long last_jump_jiffies;
 	bool abort;
+	int ps_size; /* declared param size, bytes */
 } atom_exec_context;
 
 int atom_debug = 0;
@@ -224,6 +225,12 @@
 	case ATOM_ARG_PS:
 		idx = U8(*ptr);
 		(*ptr)++;
+		if (idx + 4 > ctx->ps_size) {
+			DRM_ERROR("ATOM: ps read beyond params: %d vs. %d\n",
+				  idx, ctx->ps_size);
+			val = 0;
+			break;
+		}
 		/* get_unaligned_le32 avoids unaligned accesses from atombios
 		 * tables, noticed on a DEC Alpha. */
 		val = get_unaligned_le32((u32 *)&ctx->ps[idx]);
@@ -502,6 +509,11 @@
 		idx = U8(*ptr);
 		(*ptr)++;
 		ATOM_DEBUG_PRINT("PS[0x%02X]", idx);
+		if (idx + 4 > ctx->ps_size) {
+			DRM_ERROR("ATOM: ps write beyond params: %d vs. %d\n",
+				  idx, ctx->ps_size);
+			break;
+		}
 		ctx->ps[idx] = cpu_to_le32(val);
 		break;
 	case ATOM_ARG_WS:
@@ -1180,6 +1192,7 @@
 
 	ectx.ctx = ctx;
 	ectx.ps_shift = ps / 4;
+	ectx.ps_size = ps;
 	ectx.start = base;
 	ectx.ps = params;
 	ectx.abort = false;