Module Name: src
Committed By: skrll
Date: Mon Jan 30 21:27:19 UTC 2017
Modified Files:
src/sys/dev/usb: ohci.c
Log Message:
Fix the range check for a single TD maximum transfer length
kern/51528 usb_mem.c panic triggered by mounting USB pen drive
To generate a diff of this commit:
cvs rdiff -u -r1.265 -r1.266 src/sys/dev/usb/ohci.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/usb/ohci.c
diff -u src/sys/dev/usb/ohci.c:1.265 src/sys/dev/usb/ohci.c:1.266
--- src/sys/dev/usb/ohci.c:1.265 Sun Dec 4 10:12:35 2016
+++ src/sys/dev/usb/ohci.c Mon Jan 30 21:27:19 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: ohci.c,v 1.265 2016/12/04 10:12:35 skrll Exp $ */
+/* $NetBSD: ohci.c,v 1.266 2017/01/30 21:27:19 skrll Exp $ */
/*
* Copyright (c) 1998, 2004, 2005, 2012 The NetBSD Foundation, Inc.
@@ -41,7 +41,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ohci.c,v 1.265 2016/12/04 10:12:35 skrll Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ohci.c,v 1.266 2017/01/30 21:27:19 skrll Exp $");
#ifdef _KERNEL_OPT
#include "opt_usb.h"
@@ -632,7 +632,7 @@ ohci_reset_std_chain(ohci_softc_t *sc, s
* crossing per TD
*/
curlen = len;
- if (!(sphyspg == ephyspg || sphyspg + 1 == ephyspg)) {
+ if (!(sphyspg == ephyspg || sphyspg + OHCI_PAGE_SIZE == ephyspg)) {
/* must use multiple TDs, fill as much as possible. */
curlen = 2 * OHCI_PAGE_SIZE -
(sdataphys & (OHCI_PAGE_SIZE - 1));
