From owner-freebsd-bugs@FreeBSD.ORG  Tue May  4 00:50:03 2010
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 415DA106566C
	for <freebsd-bugs@hub.freebsd.org>;
	Tue,  4 May 2010 00:50:03 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org [69.147.83.40])
	by mx1.freebsd.org (Postfix) with ESMTP id 31C558FC18
	for <freebsd-bugs@hub.freebsd.org>;
	Tue,  4 May 2010 00:50:03 +0000 (UTC)
Received: from freefall.freebsd.org (localhost [127.0.0.1])
	by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id o440o3gb089123
	for <freebsd-bugs@freefall.freebsd.org>; Tue, 4 May 2010 00:50:03 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.14.4/8.14.4/Submit) id o440o35n089120;
	Tue, 4 May 2010 00:50:03 GMT (envelope-from gnats)
Date: Tue, 4 May 2010 00:50:03 GMT
Message-Id: <201005040050.o440o35n089120@freefall.freebsd.org>
To: freebsd-bugs@FreeBSD.org
From: dfilter@FreeBSD.ORG (dfilter service)
Cc: 
Subject: Re: kern/136726: commit references a PR
X-BeenThere: freebsd-bugs@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: dfilter service <dfilter@FreeBSD.ORG>
List-Id: Bug reports <freebsd-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-bugs>
List-Post: <mailto:freebsd-bugs@freebsd.org>
List-Help: <mailto:freebsd-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 04 May 2010 00:50:03 -0000

The following reply was made to PR kern/136726; it has been noted by GNATS.

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/136726: commit references a PR
Date: Tue,  4 May 2010 00:42:12 +0000 (UTC)

 Author: delphij
 Date: Tue May  4 00:42:03 2010
 New Revision: 207591
 URL: http://svn.freebsd.org/changeset/base/207591
 
 Log:
   MFC r195724 (mav):
   
   Limit IOCATAREQUEST ioctl data size to controller's maximum I/O size.
   It fixes kernel panic when requested size is too large (0xffffffff),
   
   PR:	kern/136726
 
 Modified:
   stable/6/sys/dev/ata/ata-all.c
 Directory Properties:
   stable/6/sys/   (props changed)
   stable/6/sys/contrib/pf/   (props changed)
   stable/6/sys/dev/cxgb/   (props changed)
 
 Modified: stable/6/sys/dev/ata/ata-all.c
 ==============================================================================
 --- stable/6/sys/dev/ata/ata-all.c	Mon May  3 22:32:26 2010	(r207590)
 +++ stable/6/sys/dev/ata/ata-all.c	Tue May  4 00:42:03 2010	(r207591)
 @@ -438,6 +438,7 @@ int
  ata_device_ioctl(device_t dev, u_long cmd, caddr_t data)
  {
      struct ata_device *atadev = device_get_softc(dev);
 +    struct ata_channel *ch = device_get_softc(device_get_parent(dev));
      struct ata_ioc_request *ioc_request = (struct ata_ioc_request *)data;
      struct ata_params *params = (struct ata_params *)data;
      int *mode = (int *)data;
 @@ -447,6 +448,10 @@ ata_device_ioctl(device_t dev, u_long cm
  
      switch (cmd) {
      case IOCATAREQUEST:
 +	if (ioc_request->count >
 +	    (ch->dma.max_iosize ? ch->dma.max_iosize : DFLTPHYS)) {
 +		return (EFBIG);
 +	}
  	if (!(buf = malloc(ioc_request->count, M_ATA, M_NOWAIT))) {
  	    return ENOMEM;
  	}
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"