Author: emaste
Date: Fri Mar 23 02:33:30 2018
New Revision: 331409
URL: https://svnweb.freebsd.org/changeset/base/331409
Log:
MFC r331339: Correct signedness bug in drm_modeset_ctl
drm_modeset_ctl() takes a signed in from userland, does a boundscheck,
and then uses it to index into a structure and write to it. The
boundscheck only checks upper bound, and never checks for nagative
values. If the int coming from userland is negative [after conversion]
it will bypass the boundscheck, perform a negative index into an array
and write to it, causing memory corruption.
Note that this is in the "old" drm driver; this issue does not exist
in drm2.
Reported by: Ilja Van Sprundel <ivansprun...@ioactive.com>
Reviewed by: cem
Sponsored by: The FreeBSD Foundation
Modified:
stable/11/sys/dev/drm/drm_irq.c
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/sys/dev/drm/drm_irq.c
==============================================================================
--- stable/11/sys/dev/drm/drm_irq.c Fri Mar 23 02:30:29 2018
(r331408)
+++ stable/11/sys/dev/drm/drm_irq.c Fri Mar 23 02:33:30 2018
(r331409)
@@ -351,7 +351,7 @@ int drm_modeset_ctl(struct drm_device *dev, void *data
goto out;
crtc = modeset->crtc;
- if (crtc >= dev->num_crtcs) {
+ if (crtc < 0 || crtc >= dev->num_crtcs) {
ret = EINVAL;
goto out;
}
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
