Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 4 May 2010 00:50:03 GMT
From:      dfilter@FreeBSD.ORG (dfilter service)
To:        freebsd-bugs@FreeBSD.org
Subject:   Re: kern/136726: commit references a PR
Message-ID:  <201005040050.o440o35n089120@freefall.freebsd.org>

next in thread | raw e-mail | index | archive | help
The following reply was made to PR kern/136726; it has been noted by GNATS.

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/136726: commit references a PR
Date: Tue,  4 May 2010 00:42:12 +0000 (UTC)

 Author: delphij
 Date: Tue May  4 00:42:03 2010
 New Revision: 207591
 URL: http://svn.freebsd.org/changeset/base/207591
 
 Log:
   MFC r195724 (mav):
   
   Limit IOCATAREQUEST ioctl data size to controller's maximum I/O size.
   It fixes kernel panic when requested size is too large (0xffffffff),
   
   PR:	kern/136726
 
 Modified:
   stable/6/sys/dev/ata/ata-all.c
 Directory Properties:
   stable/6/sys/   (props changed)
   stable/6/sys/contrib/pf/   (props changed)
   stable/6/sys/dev/cxgb/   (props changed)
 
 Modified: stable/6/sys/dev/ata/ata-all.c
 ==============================================================================
 --- stable/6/sys/dev/ata/ata-all.c	Mon May  3 22:32:26 2010	(r207590)
 +++ stable/6/sys/dev/ata/ata-all.c	Tue May  4 00:42:03 2010	(r207591)
 @@ -438,6 +438,7 @@ int
  ata_device_ioctl(device_t dev, u_long cmd, caddr_t data)
  {
      struct ata_device *atadev = device_get_softc(dev);
 +    struct ata_channel *ch = device_get_softc(device_get_parent(dev));
      struct ata_ioc_request *ioc_request = (struct ata_ioc_request *)data;
      struct ata_params *params = (struct ata_params *)data;
      int *mode = (int *)data;
 @@ -447,6 +448,10 @@ ata_device_ioctl(device_t dev, u_long cm
  
      switch (cmd) {
      case IOCATAREQUEST:
 +	if (ioc_request->count >
 +	    (ch->dma.max_iosize ? ch->dma.max_iosize : DFLTPHYS)) {
 +		return (EFBIG);
 +	}
  	if (!(buf = malloc(ioc_request->count, M_ATA, M_NOWAIT))) {
  	    return ENOMEM;
  	}
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201005040050.o440o35n089120>