⬢ DragonFlyBSD Kernel Audit
DF-4636 / fix.diff
← back to finding ↓ download raw 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
--- a/sys/dev/drm/radeon/radeon_acpi.c
+++ b/sys/dev/drm/radeon/radeon_acpi.c
@@ -206,16 +206,28 @@
 	info = radeon_atif_call(handle, ATIF_FUNCTION_VERIFY_INTERFACE, NULL);
 	if (!info)
 		return -EIO;
+	if (info->Type != ACPI_TYPE_BUFFER || info->Buffer.Pointer == NULL ||
+	    info->Buffer.Length < 2) {
+		DRM_INFO("ATIF returned an invalid object (type %u, length %u)\n",
+		    info->Type, info->Buffer.Length);
+		AcpiOsFree(info);
+		return -EINVAL;
+	}
 
 	memset(&output, 0, sizeof(output));
 
 	size = *(u16 *) info->Buffer.Pointer;
-	if (size < 12) {
+	if (size < 12 || info->Buffer.Length < size) {
 		DRM_INFO("ATIF buffer is too small: %zu\n", size);
 		err = -EINVAL;
 		goto out;
 	}
 	size = min(sizeof(output), size);
+	if (info->Buffer.Length < size) {
+		DRM_INFO("ATCS buffer is truncated\n");
+		err = -EINVAL;
+		goto out;
+	}
 
 	memcpy(&output, info->Buffer.Pointer, size);
 
@@ -255,6 +267,13 @@
 		err = -EIO;
 		goto out;
 	}
+	if (info->Type != ACPI_TYPE_BUFFER || info->Buffer.Pointer == NULL ||
+	    info->Buffer.Length < 2) {
+		DRM_INFO("ATIF returned an invalid object (type %u, length %u)\n",
+		    info->Type, info->Buffer.Length);
+		err = -EINVAL;
+		goto out;
+	}
 
 	size = *(u16 *) info->Buffer.Pointer;
 	if (size < 10) {
@@ -264,6 +283,11 @@
 
 	memset(&params, 0, sizeof(params));
 	size = min(sizeof(params), size);
+	if (info->Buffer.Length < size) {
+		DRM_INFO("ATIF system params buffer is truncated\n");
+		err = -EINVAL;
+		goto out;
+	}
 	memcpy(&params, info->Buffer.Pointer, size);
 
 	DRM_DEBUG_DRIVER("SYSTEM_PARAMS: mask = %#x, flags = %#x\n",
@@ -314,6 +338,13 @@
 	info = radeon_atif_call(handle, ATIF_FUNCTION_GET_SYSTEM_BIOS_REQUESTS, NULL);
 	if (!info)
 		return -EIO;
+	if (info->Type != ACPI_TYPE_BUFFER || info->Buffer.Pointer == NULL ||
+	    info->Buffer.Length < 2) {
+		DRM_INFO("ATIF returned an invalid object (type %u, length %u)\n",
+		    info->Type, info->Buffer.Length);
+		AcpiOsFree(info);
+		return -EINVAL;
+	}
 
 	size = *(u16 *)info->Buffer.Pointer;
 	if (size < 0xd) {
@@ -323,6 +354,11 @@
 	memset(req, 0, sizeof(*req));
 
 	size = min(sizeof(*req), size);
+	if (info->Buffer.Length < size) {
+		DRM_INFO("ATIF sbios requests buffer is truncated\n");
+		count = -EINVAL;
+		goto out;
+	}
 	memcpy(req, info->Buffer.Pointer, size);
 	DRM_DEBUG_DRIVER("SBIOS pending requests: %#x\n", req->pending);
 
@@ -488,11 +524,18 @@
 	info = radeon_atcs_call(handle, ATCS_FUNCTION_VERIFY_INTERFACE, NULL);
 	if (!info)
 		return -EIO;
+	if (info->Type != ACPI_TYPE_BUFFER || info->Buffer.Pointer == NULL ||
+	    info->Buffer.Length < 2) {
+		DRM_INFO("ATCS returned an invalid object (type %u, length %u)\n",
+		    info->Type, info->Buffer.Length);
+		AcpiOsFree(info);
+		return -EINVAL;
+	}
 
 	memset(&output, 0, sizeof(output));
 
 	size = *(u16 *) info->Buffer.Pointer;
-	if (size < 8) {
+	if (size < 8 || info->Buffer.Length < size) {
 		DRM_INFO("ATCS buffer is too small: %zu\n", size);
 		err = -EINVAL;
 		goto out;