git: e4e41b39a4dc - stable/12 - iir: prevent negative offsets in ioctl

From: Ed Maste <emaste_at_FreeBSD.org>
Date: Sat, 09 Sep 2023 15:18:14 UTC
The branch stable/12 has been updated by emaste:

URL: https://cgit.FreeBSD.org/src/commit/?id=e4e41b39a4dc22a31c7d239ca1ac29bdd6c10b47

commit e4e41b39a4dc22a31c7d239ca1ac29bdd6c10b47
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2023-08-28 03:38:30 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2023-09-09 15:16:19 +0000

    iir: prevent negative offsets in ioctl
    
    MFS of direct commit to stable/13 as this driver has been removed from
    main in commit 399188a2c60c ("iir: Remove").
    
    PR:             273328
    Reported by:    ChenHao Lu
    Sponsored by:   The FreeBSD Foundation
    
    (cherry picked from commit b5a5a06fc012d27c6937776bff8469ea465c3873)
---
 sys/dev/iir/iir.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/dev/iir/iir.c b/sys/dev/iir/iir.c
index 35ceef8d66a5..f6430b7c5a71 100644
--- a/sys/dev/iir/iir.c
+++ b/sys/dev/iir/iir.c
@@ -1855,7 +1855,7 @@ int gdt_read_event(int handle, gdt_evt_str *estr)
         eindex = handle;
     estr->event_source = 0;
 
-    if (eindex >= GDT_MAX_EVENTS) {
+    if (eindex < 0 || eindex >= GDT_MAX_EVENTS) {
 	mtx_unlock(&elock);
         return eindex;
     }