summaryrefslogtreecommitdiff
path: root/sys/dev/i2o
diff options
context:
space:
mode:
authormsaitoh <msaitoh@NetBSD.org>2015-08-16 19:21:33 +0000
committermsaitoh <msaitoh@NetBSD.org>2015-08-16 19:21:33 +0000
commit57d2ecf1548304cef7846fe0aec5f3eeccec2b97 (patch)
tree2b45e58b546efe256133a994c8a9e0b94894ad54 /sys/dev/i2o
parent0816f4a9f915c8a6887cb0793bb309ebc4433b89 (diff)
Fix a buffer pointer check in iop_msg_unmap(). The number of im_xfer
is IOP_MAX_MSG_XFERS and it's three. iop_systab_set() makes three ximit buffers. In this case, iop_msg_unmap() overrruns by "if((++ix)->ix_size == 0)". Check overrun first. This change fixes a bug that iop(4) panics while attaching iopsp(4).
Diffstat (limited to 'sys/dev/i2o')
-rw-r--r--sys/dev/i2o/iop.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/sys/dev/i2o/iop.c b/sys/dev/i2o/iop.c
index 025dc3667b6..e431d8185af 100644
--- a/sys/dev/i2o/iop.c
+++ b/sys/dev/i2o/iop.c
@@ -1,4 +1,4 @@
-/* $NetBSD: iop.c,v 1.86 2014/07/25 08:10:37 dholland Exp $ */
+/* $NetBSD: iop.c,v 1.87 2015/08/16 19:21:33 msaitoh Exp $ */
/*-
* Copyright (c) 2000, 2001, 2002, 2007 The NetBSD Foundation, Inc.
@@ -34,7 +34,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: iop.c,v 1.86 2014/07/25 08:10:37 dholland Exp $");
+__KERNEL_RCSID(0, "$NetBSD: iop.c,v 1.87 2015/08/16 19:21:33 msaitoh Exp $");
#include "iop.h"
@@ -2088,10 +2088,10 @@ iop_msg_unmap(struct iop_softc *sc, struct iop_msg *im)
/* Only the first DMA map is static. */
if (i != 0)
bus_dmamap_destroy(sc->sc_dmat, ix->ix_map);
- if ((++ix)->ix_size == 0)
- break;
if (++i >= IOP_MAX_MSG_XFERS)
break;
+ if ((++ix)->ix_size == 0)
+ break;
}
}