Module Name: src
Committed By: msaitoh
Date: Sun Aug 16 19:21:33 UTC 2015
Modified Files:
src/sys/dev/i2o: iop.c
Log Message:
Fix a buffer pointer check in iop_msg_unmap(). The number of im_xfer
is IOP_MAX_MSG_XFERS and it's three. iop_systab_set() makes three ximit
buffers. In this case, iop_msg_unmap() overrruns by "if((++ix)->ix_size == 0)".
Check overrun first.
This change fixes a bug that iop(4) panics while attaching iopsp(4).
To generate a diff of this commit:
cvs rdiff -u -r1.86 -r1.87 src/sys/dev/i2o/iop.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/i2o/iop.c
diff -u src/sys/dev/i2o/iop.c:1.86 src/sys/dev/i2o/iop.c:1.87
--- src/sys/dev/i2o/iop.c:1.86 Fri Jul 25 08:10:37 2014
+++ src/sys/dev/i2o/iop.c Sun Aug 16 19:21:33 2015
@@ -1,4 +1,4 @@
-/* $NetBSD: iop.c,v 1.86 2014/07/25 08:10:37 dholland Exp $ */
+/* $NetBSD: iop.c,v 1.87 2015/08/16 19:21:33 msaitoh Exp $ */
/*-
* Copyright (c) 2000, 2001, 2002, 2007 The NetBSD Foundation, Inc.
@@ -34,7 +34,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: iop.c,v 1.86 2014/07/25 08:10:37 dholland Exp $");
+__KERNEL_RCSID(0, "$NetBSD: iop.c,v 1.87 2015/08/16 19:21:33 msaitoh Exp $");
#include "iop.h"
@@ -2088,10 +2088,10 @@ iop_msg_unmap(struct iop_softc *sc, stru
/* Only the first DMA map is static. */
if (i != 0)
bus_dmamap_destroy(sc->sc_dmat, ix->ix_map);
- if ((++ix)->ix_size == 0)
- break;
if (++i >= IOP_MAX_MSG_XFERS)
break;
+ if ((++ix)->ix_size == 0)
+ break;
}
}
