DragonFlyBSD Kernel Audit
DF-1746 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/drm/ttm/ttm_bo_util.c b/sys/dev/drm/ttm/ttm_bo_util.c
--- a/sys/dev/drm/ttm/ttm_bo_util.c
+++ b/sys/dev/drm/ttm/ttm_bo_util.c
@@ -605,12 +605,10 @@
 	unsigned long offset, size;
 	int ret;
 
-	map->virtual = NULL;
-	map->bo = bo;
-	if (num_pages > bo->num_pages)
-		return -EINVAL;
-	if (start_page > bo->num_pages)
-		return -EINVAL;
+	map->virtual = NULL;
+	map->bo = bo;
+	if (num_pages == 0 || start_page + num_pages > bo->num_pages)
+		return -EINVAL;
 
 	(void) ttm_mem_io_lock(man, false);
 	ret = ttm_mem_io_reserve(bo->bdev, &bo->mem);