diff options
| author | msaitoh <msaitoh@NetBSD.org> | 2015-08-16 19:21:33 +0000 |
|---|---|---|
| committer | msaitoh <msaitoh@NetBSD.org> | 2015-08-16 19:21:33 +0000 |
| commit | 57d2ecf1548304cef7846fe0aec5f3eeccec2b97 (patch) | |
| tree | 2b45e58b546efe256133a994c8a9e0b94894ad54 /sys/dev/i2o | |
| parent | 0816f4a9f915c8a6887cb0793bb309ebc4433b89 (diff) | |
Fix a buffer pointer check in iop_msg_unmap(). The number of im_xfer
is IOP_MAX_MSG_XFERS and it's three. iop_systab_set() makes three ximit
buffers. In this case, iop_msg_unmap() overrruns by "if((++ix)->ix_size == 0)".
Check overrun first.
This change fixes a bug that iop(4) panics while attaching iopsp(4).
Diffstat (limited to 'sys/dev/i2o')
| -rw-r--r-- | sys/dev/i2o/iop.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/sys/dev/i2o/iop.c b/sys/dev/i2o/iop.c index 025dc3667b6..e431d8185af 100644 --- a/sys/dev/i2o/iop.c +++ b/sys/dev/i2o/iop.c @@ -1,4 +1,4 @@ -/* $NetBSD: iop.c,v 1.86 2014/07/25 08:10:37 dholland Exp $ */ +/* $NetBSD: iop.c,v 1.87 2015/08/16 19:21:33 msaitoh Exp $ */ /*- * Copyright (c) 2000, 2001, 2002, 2007 The NetBSD Foundation, Inc. @@ -34,7 +34,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: iop.c,v 1.86 2014/07/25 08:10:37 dholland Exp $"); +__KERNEL_RCSID(0, "$NetBSD: iop.c,v 1.87 2015/08/16 19:21:33 msaitoh Exp $"); #include "iop.h" @@ -2088,10 +2088,10 @@ iop_msg_unmap(struct iop_softc *sc, struct iop_msg *im) /* Only the first DMA map is static. */ if (i != 0) bus_dmamap_destroy(sc->sc_dmat, ix->ix_map); - if ((++ix)->ix_size == 0) - break; if (++i >= IOP_MAX_MSG_XFERS) break; + if ((++ix)->ix_size == 0) + break; } } |
