Module Name: src Committed By: drochner Date: Thu Feb 24 19:28:04 UTC 2011
Modified Files: src/sys/opencrypto: criov.c Log Message: Don't panic, just truncate, if the iov is too short in a COPYBACK. This case can be triggered from userland cryptodev if the buffer for decompressed data is too small. (It would look cleaner if the lengths would be passed explicitely everywhere, but that would thwart the abstraction done by COPYDATA/COPYBACK which allows to treat mbufs and iovs the same way.) To generate a diff of this commit: cvs rdiff -u -r1.7 -r1.8 src/sys/opencrypto/criov.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/opencrypto/criov.c diff -u src/sys/opencrypto/criov.c:1.7 src/sys/opencrypto/criov.c:1.8 --- src/sys/opencrypto/criov.c:1.7 Sat Mar 14 21:04:26 2009 +++ src/sys/opencrypto/criov.c Thu Feb 24 19:28:03 2011 @@ -1,4 +1,4 @@ -/* $NetBSD: criov.c,v 1.7 2009/03/14 21:04:26 dsl Exp $ */ +/* $NetBSD: criov.c,v 1.8 2011/02/24 19:28:03 drochner Exp $ */ /* $OpenBSD: criov.c,v 1.11 2002/06/10 19:36:43 espie Exp $ */ /* @@ -29,7 +29,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: criov.c,v 1.7 2009/03/14 21:04:26 dsl Exp $"); +__KERNEL_RCSID(0, "$NetBSD: criov.c,v 1.8 2011/02/24 19:28:03 drochner Exp $"); #include <sys/param.h> #include <sys/systm.h> @@ -90,8 +90,12 @@ if (len < 0) panic("cuio_copyback: len %d < 0", len); while (off > 0) { - if (iol == 0) - panic("cuio_copyback: empty in skip"); + if (iol == 0) { +#ifdef DEBUG + printf("cuio_copyback: empty in skip\n"); +#endif + return; + } if (off < iov->iov_len) break; off -= iov->iov_len; @@ -99,8 +103,12 @@ iov++; } while (len > 0) { - if (iol == 0) - panic("uio_copyback: empty"); + if (iol == 0) { +#ifdef DEBUG + printf("uio_copyback: empty\n"); +#endif + return; + } count = min(iov->iov_len - off, len); memcpy((char *)iov->iov_base + off, cp, count); len -= count;