⬢ DragonFlyBSD Kernel Audit
DF-3852 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
--- a/sys/dev/drm/radeon/radeon_combios.c
+++ b/sys/dev/drm/radeon/radeon_combios.c
@@ -2746,18 +2746,24 @@
 						false;
 				rdev->pm.power_state[state_index].clock_info[0].voltage.gpio.valid = true;
 				if (rev < 6) {
-					rdev->pm.power_state[state_index].clock_info[0].voltage.gpio.reg =
-						RBIOS16(offset + 0x5 + 0xb) * 4;
+					u32 gpio_reg = RBIOS16(offset + 0x5 + 0xb) * 4;
 					tmp = RBIOS8(offset + 0x5 + 0xd);
-					rdev->pm.power_state[state_index].clock_info[0].voltage.gpio.mask = (1 << tmp);
+					if ((gpio_reg < 0x10000) && (tmp < 32)) {
+						rdev->pm.power_state[state_index].clock_info[0].voltage.gpio.reg = gpio_reg;
+						rdev->pm.power_state[state_index].clock_info[0].voltage.gpio.mask = (1 << tmp);
+					} else
+						rdev->pm.power_state[state_index].clock_info[0].voltage.gpio.valid = false;
 				} else {
 					u8 entries = RBIOS8(offset + 0x5 + 0xb);
 					u16 voltage_table_offset = RBIOS16(offset + 0x5 + 0xc);
 					if (entries && voltage_table_offset) {
-						rdev->pm.power_state[state_index].clock_info[0].voltage.gpio.reg =
-							RBIOS16(voltage_table_offset) * 4;
+						u32 gpio_reg = RBIOS16(voltage_table_offset) * 4;
 						tmp = RBIOS8(voltage_table_offset + 0x2);
-						rdev->pm.power_state[state_index].clock_info[0].voltage.gpio.mask = (1 << tmp);
+						if ((gpio_reg < 0x10000) && (tmp < 32)) {
+							rdev->pm.power_state[state_index].clock_info[0].voltage.gpio.reg = gpio_reg;
+							rdev->pm.power_state[state_index].clock_info[0].voltage.gpio.mask = (1 << tmp);
+						} else
+							rdev->pm.power_state[state_index].clock_info[0].voltage.gpio.valid = false;
 					} else
 						rdev->pm.power_state[state_index].clock_info[0].voltage.gpio.valid = false;
 				}