Author: mav
Date: Mon Jan 26 15:47:08 2015
New Revision: 277758
URL: https://svnweb.freebsd.org/changeset/base/277758

Log:
  Fix several potential overflows in UNMAP code.
  
  MFC after:    1 week

Modified:
  head/sys/cam/scsi/scsi_da.c

Modified: head/sys/cam/scsi/scsi_da.c
==============================================================================
--- head/sys/cam/scsi/scsi_da.c Mon Jan 26 13:59:39 2015        (r277757)
+++ head/sys/cam/scsi/scsi_da.c Mon Jan 26 15:47:08 2015        (r277758)
@@ -1910,18 +1910,18 @@ dadeletemaxsize(struct da_softc *softc, 
                sectors = (off_t)ATA_DSM_RANGE_MAX * softc->trim_max_ranges;
                break;
        case DA_DELETE_WS16:
-               sectors = (off_t)min(softc->ws_max_blks, WS16_MAX_BLKS);
+               sectors = omin(softc->ws_max_blks, WS16_MAX_BLKS);
                break;
        case DA_DELETE_ZERO:
        case DA_DELETE_WS10:
-               sectors = (off_t)min(softc->ws_max_blks, WS10_MAX_BLKS);
+               sectors = omin(softc->ws_max_blks, WS10_MAX_BLKS);
                break;
        default:
                return 0;
        }
 
        return (off_t)softc->params.secsize *
-           min(sectors, (off_t)softc->params.sectors);
+           omin(sectors, softc->params.sectors);
 }
 
 static void
@@ -2684,7 +2684,7 @@ da_delete_trim(struct cam_periph *periph
 
                /* Try to extend the previous range. */
                if (lba == lastlba) {
-                       c = min(count, ATA_DSM_RANGE_MAX - lastcount);
+                       c = omin(count, ATA_DSM_RANGE_MAX - lastcount);
                        lastcount += c;
                        off = (ranges - 1) * 8;
                        buf[off + 6] = lastcount & 0xff;
@@ -2694,7 +2694,7 @@ da_delete_trim(struct cam_periph *periph
                }
 
                while (count > 0) {
-                       c = min(count, ATA_DSM_RANGE_MAX);
+                       c = omin(count, ATA_DSM_RANGE_MAX);
                        off = ranges * 8;
 
                        buf[off + 0] = lba & 0xff;
@@ -2770,7 +2770,7 @@ da_delete_ws(struct cam_periph *periph, 
                            "%s issuing short delete %ld > %ld\n",
                            da_delete_method_desc[softc->delete_method],
                            count, ws_max_blks);
-                       count = min(count, ws_max_blks);
+                       count = omin(count, ws_max_blks);
                        break;
                }
                bp1 = bioq_first(&softc->delete_queue);
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"

Reply via email to