svn commit: r331339 - head/sys/dev/drm

[Ed Maste]

Author: emaste
Date: Thu Mar 22 01:00:55 2018
New Revision: 331339
URL: https://svnweb.freebsd.org/changeset/base/331339

Log:
  Correct signedness bug in drm_modeset_ctl
  
  drm_modeset_ctl() takes a signed in from userland, does a boundscheck,
  and then uses it to index into a structure and write to it.  The
  boundscheck only checks upper bound, and never checks for nagative
  values.  If the int coming from userland is negative [after conversion]
  it will bypass the boundscheck, perform a negative index into an array
  and write to it, causing memory corruption.
  
  Note that this is in the "old" drm driver; this issue does not exist
  in drm2.
  
  Reported by:	Ilja Van Sprundel <ivansprundel at ioactive.com>
  Reviewed by:	cem
  MFC after:	1 day
  Sponsored by:	The FreeBSD Foundation

Modified:
  head/sys/dev/drm/drm_irq.c

Modified: head/sys/dev/drm/drm_irq.c
==============================================================================
--- head/sys/dev/drm/drm_irq.c	Thu Mar 22 00:55:36 2018	(r331338)
+++ head/sys/dev/drm/drm_irq.c	Thu Mar 22 01:00:55 2018	(r331339)
@@ -351,7 +351,7 @@ int drm_modeset_ctl(struct drm_device *dev, void *data
 		goto out;
 
 	crtc = modeset->crtc;
-	if (crtc >= dev->num_crtcs) {
+	if (crtc < 0 || crtc >= dev->num_crtcs) {
 		ret = EINVAL;
 		goto out;
 	}