Martin Natano wrote:
> Below the conversion to uiomove() for kern/spec_vnops.c. This diff
> prevents truncation of uio_resid when passed to min().
Looks good. Basically the same reasoning as with the cd9660 diff.
ok?
> Index: kern/spec_vnops.c
> ===================================================================
> RCS file: /cvs/src/sys/kern/spec_vnops.c,v
> retrieving revision 1.84
> diff -u -p -u -r1.84 spec_vnops.c
> --- kern/spec_vnops.c 5 Dec 2015 10:11:53 -0000 1.84
> +++ kern/spec_vnops.c 13 Jan 2016 19:12:40 -0000
> @@ -202,7 +202,8 @@ spec_read(void *v)
> daddr_t bn, nextbn, bscale;
> int bsize;
> struct partinfo dpart;
> - int n, on, majordev;
> + size_t n;
> + int on, majordev;
> int (*ioctl)(dev_t, u_long, caddr_t, int, struct proc *);
> int error = 0;
>
> @@ -243,7 +244,7 @@ spec_read(void *v)
> do {
> bn = btodb(uio->uio_offset) & ~(bscale - 1);
> on = uio->uio_offset % bsize;
> - n = min((bsize - on), uio->uio_resid);
> + n = ulmin((bsize - on), uio->uio_resid);
> if (vp->v_lastr + bscale == bn) {
> nextbn = bn + bscale;
> error = breadn(vp, bn, bsize, &nextbn, &bsize,
> @@ -251,12 +252,12 @@ spec_read(void *v)
> } else
> error = bread(vp, bn, bsize, &bp);
> vp->v_lastr = bn;
> - n = min(n, bsize - bp->b_resid);
> + n = ulmin(n, bsize - bp->b_resid);
> if (error) {
> brelse(bp);
> return (error);
> }
> - error = uiomovei((char *)bp->b_data + on, n, uio);
> + error = uiomove((char *)bp->b_data + on, n, uio);
> brelse(bp);
> } while (error == 0 && uio->uio_resid > 0 && n != 0);
> return (error);
> @@ -290,7 +291,8 @@ spec_write(void *v)
> daddr_t bn, bscale;
> int bsize;
> struct partinfo dpart;
> - int n, on, majordev;
> + size_t n;
> + int on, majordev;
> int (*ioctl)(dev_t, u_long, caddr_t, int, struct proc *);
> int error = 0;
>
> @@ -331,14 +333,14 @@ spec_write(void *v)
> do {
> bn = btodb(uio->uio_offset) & ~(bscale - 1);
> on = uio->uio_offset % bsize;
> - n = min((bsize - on), uio->uio_resid);
> + n = ulmin((bsize - on), uio->uio_resid);
> error = bread(vp, bn, bsize, &bp);
> - n = min(n, bsize - bp->b_resid);
> + n = ulmin(n, bsize - bp->b_resid);
> if (error) {
> brelse(bp);
> return (error);
> }
> - error = uiomovei((char *)bp->b_data + on, n, uio);
> + error = uiomove((char *)bp->b_data + on, n, uio);
> if (n + on == bsize)
> bawrite(bp);
> else
>
> cheers,
> natano
>
