DragonFlyBSD Kernel Audit
DF-1985 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/drm/amd/amdgpu/amdgpu_fb.c b/sys/dev/drm/amd/amdgpu/amdgpu_fb.c
--- a/sys/dev/drm/amd/amdgpu/amdgpu_fb.c
+++ b/sys/dev/drm/amd/amdgpu/amdgpu_fb.c
@@ -260,6 +260,13 @@
 #ifdef __DragonFly__
 	info->width = sizes->fb_width;
 	info->height = sizes->fb_height;
+	/* fb->pitches[0] is u32 but info->stride is uint16_t; unchecked
+	 * truncation would wrap large pitches (e.g. 65536) to 0, defeating
+	 * the syscons mmap bounds check. */
+	if (fb->pitches[0] > 0xffff) {
+		ret = -EINVAL;
+		goto out;
+	}
 	info->stride = fb->pitches[0];
 	info->depth = sizes->surface_bpp;
 	info->is_vga_boot_display = vga_pci_is_boot_display(vga_dev);