DragonFlyBSD Kernel Audit
DF-2389 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/acpica/acpi_pci_link.c b/sys/dev/acpica/acpi_pci_link.c
--- a/sys/dev/acpica/acpi_pci_link.c
+++ b/sys/dev/acpica/acpi_pci_link.c
@@ -232,8 +232,15 @@
 		break;
 	case ACPI_RESOURCE_TYPE_IRQ:
 	case ACPI_RESOURCE_TYPE_EXTENDED_IRQ:
-		KASSERT(req->link_index < req->sc->pl_num_links,
-		    ("%s: array boundary violation", __func__));
+		/* _PRS may list more IRQ resources than _CRS sized pl_links[] for;
+		   the KASSERT is a no-op on production (non-INVARIANTS) kernels, so
+		   bound-check explicitly and stop rather than overflowing. */
+		if (req->link_index >= req->sc->pl_num_links) {
+			device_printf(req->sc->pl_dev,
+			    "more IRQ resources in _PRS than _CRS (%d >= %d)\n",
+			    req->link_index, req->sc->pl_num_links);
+			return (AE_AML_NUMERIC_OVERFLOW);
+		}
 		link = &req->sc->pl_links[req->link_index];
 		link->l_res_index = req->res_index;
 		link->l_crs_type = res->Type;