svn commit: r331410 - stable/10/sys/dev/drm

[Ed Maste]

Author: emaste
Date: Fri Mar 23 02:34:45 2018
New Revision: 331410
URL: https://svnweb.freebsd.org/changeset/base/331410

Log:
  MFC r331339: Correct signedness bug in drm_modeset_ctl
  
  drm_modeset_ctl() takes a signed in from userland, does a boundscheck,
  and then uses it to index into a structure and write to it.  The
  boundscheck only checks upper bound, and never checks for nagative
  values.  If the int coming from userland is negative [after conversion]
  it will bypass the boundscheck, perform a negative index into an array
  and write to it, causing memory corruption.
  
  Note that this is in the "old" drm driver; this issue does not exist
  in drm2.
  
  Reported by:	Ilja Van Sprundel <ivansprundel at ioactive.com>
  Reviewed by:	cem
  Sponsored by:	The FreeBSD Foundation

Modified:
  stable/10/sys/dev/drm/drm_irq.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/dev/drm/drm_irq.c
==============================================================================
--- stable/10/sys/dev/drm/drm_irq.c	Fri Mar 23 02:33:30 2018	(r331409)
+++ stable/10/sys/dev/drm/drm_irq.c	Fri Mar 23 02:34:45 2018	(r331410)
@@ -357,7 +357,7 @@ int drm_modeset_ctl(struct drm_device *dev, void *data
 		goto out;
 
 	crtc = modeset->crtc;
-	if (crtc >= dev->num_crtcs) {
+	if (crtc < 0 || crtc >= dev->num_crtcs) {
 		ret = EINVAL;
 		goto out;
 	}