svn commit: r331409 - stable/11/sys/dev/drm

[Ed Maste]

Author: emaste
Date: Fri Mar 23 02:33:30 2018
New Revision: 331409
URL: https://svnweb.freebsd.org/changeset/base/331409

Log:
  MFC r331339: Correct signedness bug in drm_modeset_ctl
  
  drm_modeset_ctl() takes a signed in from userland, does a boundscheck,
  and then uses it to index into a structure and write to it.  The
  boundscheck only checks upper bound, and never checks for nagative
  values.  If the int coming from userland is negative [after conversion]
  it will bypass the boundscheck, perform a negative index into an array
  and write to it, causing memory corruption.
  
  Note that this is in the "old" drm driver; this issue does not exist
  in drm2.
  
  Reported by:	Ilja Van Sprundel <ivansprundel at ioactive.com>
  Reviewed by:	cem
  Sponsored by:	The FreeBSD Foundation

Modified:
  stable/11/sys/dev/drm/drm_irq.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/dev/drm/drm_irq.c
==============================================================================
--- stable/11/sys/dev/drm/drm_irq.c	Fri Mar 23 02:30:29 2018	(r331408)
+++ stable/11/sys/dev/drm/drm_irq.c	Fri Mar 23 02:33:30 2018	(r331409)
@@ -351,7 +351,7 @@ int drm_modeset_ctl(struct drm_device *dev, void *data
 		goto out;
 
 	crtc = modeset->crtc;
-	if (crtc >= dev->num_crtcs) {
+	if (crtc < 0 || crtc >= dev->num_crtcs) {
 		ret = EINVAL;
 		goto out;
 	}