Page MenuHomeFreeBSD

Remove dead code from radeonkms.
ClosedPublic

Authored by markj on Dec 11 2018, 8:21 PM.

Details

Summary

This is effectively the closure of the ioctl handler table in
radeon_cp.c. That ioctl table is unused (we use the radeon_kms ioctl
table instead), so there is no way for any of the functions referenced
by the table to be called.

This was motivated by a report of an integer overflow vulnerability in
r600_cp_dispatch_texture() (the multiplication of tex->height and
tex->pitch, which are user-controlled). However, I believe the code
in question cannot get invoked.

Test Plan

I verified that radeonkms.ko still loads (i.e., no missing symbols).

Initially, my test was to simply comment out the radeon_ioctls[] table
and kldload, verifying that the ioctl handlers are indeed dead code.

Diff Detail

Repository
rS FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

markj created this revision.Dec 11 2018, 8:21 PM
markj edited the summary of this revision. (Show Details)Dec 11 2018, 8:24 PM
markj edited the test plan for this revision. (Show Details)
markj added a reviewer: dumbbell.
dumbbell requested changes to this revision.Dec 17 2018, 8:17 AM

Hi!

I suppose the int2float() function comes from one of the removed file, is that right? If yes, could you please add a comment indicating the initial source filename?

This revision now requires changes to proceed.Dec 17 2018, 8:17 AM
markj updated this revision to Diff 52109.Dec 17 2018, 4:27 PM
  • Add comment indicating the origin of int2float().
markj added a comment.Dec 17 2018, 4:29 PM

Hi!
I suppose the int2float() function comes from one of the removed file, is that right? If yes, could you please add a comment indicating the initial source filename?

Indeed, r600_blit.c. I added a comment.

dumbbell accepted this revision.Dec 17 2018, 4:33 PM
This revision is now accepted and ready to land.Dec 17 2018, 4:33 PM
This revision was automatically updated to reflect the committed changes.