⬢ DragonFlyBSD Kernel Audit
DF-2021 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
diff --git a/sys/dev/drm/amd/powerplay/smumgr/vega12_smumgr.c b/sys/dev/drm/amd/powerplay/smumgr/vega12_smumgr.c
--- a/sys/dev/drm/amd/powerplay/smumgr/vega12_smumgr.c
+++ b/sys/dev/drm/amd/powerplay/smumgr/vega12_smumgr.c
@@ -43,7 +43,9 @@
 	struct vega12_smumgr *priv =
 			(struct vega12_smumgr *)(hwmgr->smu_backend);
 
-	PP_ASSERT_WITH_CODE(table_id < TABLE_COUNT,
+	/* DF-2021: table_id is int16_t; reject negatives to prevent
+	 * negative-index OOB on entry[] (only the upper bound was checked). */
+	PP_ASSERT_WITH_CODE(table_id >= 0 && table_id < TABLE_COUNT,
 			"Invalid SMU Table ID!", return -EINVAL);
 	PP_ASSERT_WITH_CODE(priv->smu_tables.entry[table_id].version != 0,
 			"Invalid SMU Table version!", return -EINVAL);
@@ -81,7 +83,8 @@
 	struct vega12_smumgr *priv =
 			(struct vega12_smumgr *)(hwmgr->smu_backend);
 
-	PP_ASSERT_WITH_CODE(table_id < TABLE_COUNT,
+	/* DF-2021: table_id is int16_t; reject negatives (see copy_from_smc). */
+	PP_ASSERT_WITH_CODE(table_id >= 0 && table_id < TABLE_COUNT,
 			"Invalid SMU Table ID!", return -EINVAL);
 	PP_ASSERT_WITH_CODE(priv->smu_tables.entry[table_id].version != 0,
 			"Invalid SMU Table version!", return -EINVAL);