DF-1985 / fix.diff
diff --git a/sys/dev/drm/amd/amdgpu/amdgpu_fb.c b/sys/dev/drm/amd/amdgpu/amdgpu_fb.c --- a/sys/dev/drm/amd/amdgpu/amdgpu_fb.c +++ b/sys/dev/drm/amd/amdgpu/amdgpu_fb.c @@ -260,6 +260,13 @@ #ifdef __DragonFly__ info->width = sizes->fb_width; info->height = sizes->fb_height; + /* fb->pitches[0] is u32 but info->stride is uint16_t; unchecked + * truncation would wrap large pitches (e.g. 65536) to 0, defeating + * the syscons mmap bounds check. */ + if (fb->pitches[0] > 0xffff) { + ret = -EINVAL; + goto out; + } info->stride = fb->pitches[0]; info->depth = sizes->surface_bpp; info->is_vga_boot_display = vga_pci_is_boot_display(vga_dev); |