Date: Thu, 22 Mar 2018 01:00:55 +0000 (UTC) From: Ed Maste <emaste@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r331339 - head/sys/dev/drm Message-ID: <201803220100.w2M10tNT006564@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: emaste Date: Thu Mar 22 01:00:55 2018 New Revision: 331339 URL: https://svnweb.freebsd.org/changeset/base/331339 Log: Correct signedness bug in drm_modeset_ctl drm_modeset_ctl() takes a signed in from userland, does a boundscheck, and then uses it to index into a structure and write to it. The boundscheck only checks upper bound, and never checks for nagative values. If the int coming from userland is negative [after conversion] it will bypass the boundscheck, perform a negative index into an array and write to it, causing memory corruption. Note that this is in the "old" drm driver; this issue does not exist in drm2. Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com> Reviewed by: cem MFC after: 1 day Sponsored by: The FreeBSD Foundation Modified: head/sys/dev/drm/drm_irq.c Modified: head/sys/dev/drm/drm_irq.c ============================================================================== --- head/sys/dev/drm/drm_irq.c Thu Mar 22 00:55:36 2018 (r331338) +++ head/sys/dev/drm/drm_irq.c Thu Mar 22 01:00:55 2018 (r331339) @@ -351,7 +351,7 @@ int drm_modeset_ctl(struct drm_device *dev, void *data goto out; crtc = modeset->crtc; - if (crtc >= dev->num_crtcs) { + if (crtc < 0 || crtc >= dev->num_crtcs) { ret = EINVAL; goto out; }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201803220100.w2M10tNT006564>