⬢ DragonFlyBSD Kernel Audit
DF-4263 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
--- a/sys/dev/drm/amd/amdgpu/amdgpu_cs.c
+++ b/sys/dev/drm/amd/amdgpu/amdgpu_cs.c
@@ -190,6 +190,11 @@
 				goto free_partial_kdata;
 			}
 
+			if (p->uf_entry.tv.bo) {
+				ret = -EINVAL;
+				goto free_partial_kdata;
+			}
+
 			ret = amdgpu_cs_user_fence_chunk(p, p->chunks[i].kdata,
 							 &uf_offset);
 			if (ret)
@@ -204,6 +209,11 @@
 				goto free_partial_kdata;
 			}
 
+			if (p->bo_list) {
+				ret = -EINVAL;
+				goto free_partial_kdata;
+			}
+
 			ret = amdgpu_cs_bo_handles_chunk(p, p->chunks[i].kdata);
 			if (ret)
 				goto free_partial_kdata;
@@ -1145,6 +1155,10 @@
 	num_deps = chunk->length_dw * 4 /
 		sizeof(struct drm_amdgpu_cs_chunk_sem);
 
+	if (p->post_dep_syncobjs) {
+		return -EINVAL;
+	}
+
 	p->post_dep_syncobjs = kmalloc_array(num_deps,
 					     sizeof(struct drm_syncobj *),
 					     GFP_KERNEL);