⬢ DragonFlyBSD Kernel Audit
DF-4144 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
--- a/dev/drm/radeon/trinity_dpm.c
+++ b/dev/drm/radeon/trinity_dpm.c
@@ -1771,14 +1771,39 @@
 	for (i = 0; i < state_array->ucNumEntries; i++) {
 		u8 *idx;
 		power_state = (union pplib_power_state *)power_state_offset;
+		if (i >= rdev->pm.num_power_states) {
+			DRM_ERROR("state count exceeds power_state table\n");
+			for (k = i - 1; k >= 0; k--)
+				kfree(rdev->pm.dpm.ps[k].ps_priv);
+			kfree(rdev->pm.dpm.ps);
+			rdev->pm.dpm.ps = NULL;
+			rdev->pm.dpm.boot_ps = NULL;
+			rdev->pm.dpm.uvd_ps = NULL;
+			return -EINVAL;
+		}
 		non_clock_array_index = power_state->v2.nonClockInfoIndex;
 		non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
 			&non_clock_info_array->nonClockInfo[non_clock_array_index];
+		if (!rdev->pm.power_state[i].clock_info) {
+			DRM_ERROR("invalid power state %d\n", i);
+			for (k = i - 1; k >= 0; k--)
+				kfree(rdev->pm.dpm.ps[k].ps_priv);
+			kfree(rdev->pm.dpm.ps);
+			rdev->pm.dpm.ps = NULL;
+			rdev->pm.dpm.boot_ps = NULL;
+			rdev->pm.dpm.uvd_ps = NULL;
+			return -EINVAL;
+		}
 		if (!rdev->pm.power_state[i].clock_info)
 			return -EINVAL;
 		ps = kzalloc(sizeof(struct sumo_ps), GFP_KERNEL);
 		if (ps == NULL) {
+			for (k = i - 1; k >= 0; k--)
+				kfree(rdev->pm.dpm.ps[k].ps_priv);
 			kfree(rdev->pm.dpm.ps);
+			rdev->pm.dpm.ps = NULL;
+			rdev->pm.dpm.boot_ps = NULL;
+			rdev->pm.dpm.uvd_ps = NULL;
 			return -ENOMEM;
 		}
 		rdev->pm.dpm.ps[i].ps_priv = ps;
@@ -2087,7 +2112,9 @@
 		kfree(rdev->pm.dpm.ps[i].ps_priv);
 	}
 	kfree(rdev->pm.dpm.ps);
+	rdev->pm.dpm.ps = NULL;
 	kfree(rdev->pm.dpm.priv);
+	rdev->pm.dpm.priv = NULL;
 	r600_free_extended_power_table(rdev);
 }