DragonFlyBSD Kernel Audit
DF-1725 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/drm/radeon/radeon_cs.c b/sys/dev/drm/radeon/radeon_cs.c
--- a/sys/dev/drm/radeon/radeon_cs.c
+++ b/sys/dev/drm/radeon/radeon_cs.c
@@ -869,6 +869,12 @@
 		return -EINVAL;
 	}
 	/* FIXME: we assume reloc size is 4 dwords */
+	if ((idx % 4) != 0 || idx / 4 >= p->nrelocs) {
+		DRM_ERROR("Relocs at %d not 4-dword aligned / past nrelocs %d!\n",
+			  idx, p->nrelocs);
+		radeon_cs_dump_packet(p, &p3reloc);
+		return -EINVAL;
+	}
 	if (nomm) {
 		*cs_reloc = p->relocs;
 		(*cs_reloc)->gpu_offset =