Date: Fri, 23 Mar 2018 02:34:45 +0000 (UTC) From: Ed Maste <emaste@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r331410 - stable/10/sys/dev/drm Message-ID: <201803230234.w2N2Yj8T080796@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: emaste Date: Fri Mar 23 02:34:45 2018 New Revision: 331410 URL: https://svnweb.freebsd.org/changeset/base/331410 Log: MFC r331339: Correct signedness bug in drm_modeset_ctl drm_modeset_ctl() takes a signed in from userland, does a boundscheck, and then uses it to index into a structure and write to it. The boundscheck only checks upper bound, and never checks for nagative values. If the int coming from userland is negative [after conversion] it will bypass the boundscheck, perform a negative index into an array and write to it, causing memory corruption. Note that this is in the "old" drm driver; this issue does not exist in drm2. Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com> Reviewed by: cem Sponsored by: The FreeBSD Foundation Modified: stable/10/sys/dev/drm/drm_irq.c Directory Properties: stable/10/ (props changed) Modified: stable/10/sys/dev/drm/drm_irq.c ============================================================================== --- stable/10/sys/dev/drm/drm_irq.c Fri Mar 23 02:33:30 2018 (r331409) +++ stable/10/sys/dev/drm/drm_irq.c Fri Mar 23 02:34:45 2018 (r331410) @@ -357,7 +357,7 @@ int drm_modeset_ctl(struct drm_device *dev, void *data goto out; crtc = modeset->crtc; - if (crtc >= dev->num_crtcs) { + if (crtc < 0 || crtc >= dev->num_crtcs) { ret = EINVAL; goto out; }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201803230234.w2N2Yj8T080796>