⬢ DragonFlyBSD Kernel Audit
DF-3956 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/drm/radeon/kv_dpm.c b/sys/dev/drm/radeon/kv_dpm.c
index 1111111..2222222 100644
--- a/sys/dev/drm/radeon/kv_dpm.c
+++ b/sys/dev/drm/radeon/kv_dpm.c
@@ -559,7 +559,11 @@ static u32 kv_convert_vid2_to_vid7(struct radeon_device *rdev,
 		else
 			return vddc_sclk_table->entries[vddc_sclk_table->count - 1].v;
 	} else {
+		if (vid_mapping_table->num_entries == 0)
+			/* empty/missing IGP vid mapping: entries[-1] would be a
+			 * ~16 GiB wild read (u32 num_entries - 1 = 0xFFFFFFFF) */
+			return 0;
 		for (i = 0; i < vid_mapping_table->num_entries; i++) {
 			if (vid_mapping_table->entries[i].vid_2bit == vid_2bit)
 				return vid_mapping_table->entries[i].vid_7bit;
 		}
@@ -582,7 +586,11 @@ static u32 kv_convert_vid7_to_vid2(struct radeon_device *rdev,
 		}
 		return vddc_sclk_table->count - 1;
 	} else {
+		if (vid_mapping_table->num_entries == 0)
+			/* see kv_convert_vid2_to_vid7() above */
+			return 0;
 		for (i = 0; i < vid_mapping_table->num_entries; i++) {
 			if (vid_mapping_table->entries[i].vid_7bit == vid_7bit)
 				return vid_mapping_table->entries[i].vid_2bit;
 		}