DragonFlyBSD Kernel Audit
DF-1543 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/drm/amd/amdgpu/atom.c b/sys/dev/drm/amd/amdgpu/atom.c
--- a/sys/dev/drm/amd/amdgpu/atom.c
+++ b/sys/dev/drm/amd/amdgpu/atom.c
@@ -270,8 +270,8 @@
 	case ATOM_ARG_FB:
 		idx = U8(*ptr);
 		(*ptr)++;
-		if ((gctx->fb_base + (idx * 4)) > gctx->scratch_size_bytes) {
-			DRM_ERROR("ATOM: fb read beyond scratch region: %d vs. %d\n",
+		if ((uint64_t)gctx->fb_base + (uint64_t)(idx * 4) > (uint64_t)gctx->scratch_size_bytes) {
+			DRM_ERROR("ATOM: fb read beyond scratch region: %u vs. %d\n",
 				  gctx->fb_base + (idx * 4), gctx->scratch_size_bytes);
 			val = 0;
 		} else
@@ -526,8 +526,8 @@
 	case ATOM_ARG_FB:
 		idx = U8(*ptr);
 		(*ptr)++;
-		if ((gctx->fb_base + (idx * 4)) > gctx->scratch_size_bytes) {
-			DRM_ERROR("ATOM: fb write beyond scratch region: %d vs. %d\n",
+		if ((uint64_t)gctx->fb_base + (uint64_t)(idx * 4) > (uint64_t)gctx->scratch_size_bytes) {
+			DRM_ERROR("ATOM: fb write beyond scratch region: %u vs. %d\n",
 				  gctx->fb_base + (idx * 4), gctx->scratch_size_bytes);
 		} else
 			gctx->scratch[(gctx->fb_base / 4) + idx] = val;