⬢ DragonFlyBSD Kernel Audit
DF-5652 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
--- sys/platform/pc64/icu/elcr.c
+++ sys/platform/pc64/icu/elcr.c
@@ -82,12 +82,16 @@
 /*
  * Returns 1 for level trigger, 0 for edge.
  */
 enum intr_trigger
 elcr_read_trigger(int irq)
 {
 	KASSERT(elcr_found, ("%s: no ELCR was found!", __func__));
-	KASSERT(irq < ISA_IRQ_CNT, ("%s: invalid IRQ %u", __func__, irq));
+	KASSERT(irq >= 0 && irq < ISA_IRQ_CNT,
+	    ("%s: invalid IRQ %u", __func__, irq));
+	if (irq < 0 || irq >= ISA_IRQ_CNT)	/* real guard: KASSERT is
+						 * INVARIANTS-only (systm.h) */
+		return (INTR_TRIGGER_EDGE);
 	if (elcr_status & ELCR_MASK(irq))
 		return (INTR_TRIGGER_LEVEL);
 	else
 		return (INTR_TRIGGER_EDGE);
 }
@@ -96,12 +100,17 @@
 /*
  * Set the trigger mode for a specified IRQ.  Mode of 0 means edge triggered,
  * and a mode of 1 means level triggered.
  */
 void
 elcr_write_trigger(int irq, enum intr_trigger trigger)
 {
 	int new_status;
 
 	KASSERT(elcr_found, ("%s: no ELCR was found!", __func__));
-	KASSERT(irq < ISA_IRQ_CNT, ("%s: invalid IRQ %u", __func__, irq));
+	KASSERT(irq >= 0 && irq < ISA_IRQ_CNT,
+	    ("%s: invalid IRQ %u", __func__, irq));
+	if (irq < 0 || irq >= ISA_IRQ_CNT)	/* real guard: never touch the
+						 * ELCR ports with a wild irq */
+		return;
 	if (trigger == INTR_TRIGGER_LEVEL)
 		new_status = elcr_status | ELCR_MASK(irq);
 	else