From owner-freebsd-bugs@FreeBSD.ORG  Thu Jul 30 13:20:12 2009
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 92367106564A
	for <freebsd-bugs@hub.freebsd.org>;
	Thu, 30 Jul 2009 13:20:12 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org
	[IPv6:2001:4f8:fff6::28])
	by mx1.freebsd.org (Postfix) with ESMTP id 80E948FC1E
	for <freebsd-bugs@hub.freebsd.org>;
	Thu, 30 Jul 2009 13:20:12 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n6UDKCdI057910
	for <freebsd-bugs@freefall.freebsd.org>; Thu, 30 Jul 2009 13:20:12 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n6UDKC8f057909;
	Thu, 30 Jul 2009 13:20:12 GMT (envelope-from gnats)
Date: Thu, 30 Jul 2009 13:20:12 GMT
Message-Id: <200907301320.n6UDKC8f057909@freefall.freebsd.org>
To: freebsd-bugs@FreeBSD.org
From: dfilter@FreeBSD.ORG (dfilter service)
Cc: 
Subject: Re: kern/136726: commit references a PR
X-BeenThere: freebsd-bugs@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: dfilter service <dfilter@FreeBSD.ORG>
List-Id: Bug reports <freebsd-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-bugs>
List-Post: <mailto:freebsd-bugs@freebsd.org>
List-Help: <mailto:freebsd-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 30 Jul 2009 13:20:12 -0000

The following reply was made to PR kern/136726; it has been noted by GNATS.

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/136726: commit references a PR
Date: Thu, 30 Jul 2009 13:19:28 +0000 (UTC)

 Author: mav
 Date: Thu Jul 30 13:19:12 2009
 New Revision: 195973
 URL: http://svn.freebsd.org/changeset/base/195973
 
 Log:
   MFC rev. 195724:
   
   Limit IOCATAREQUEST ioctl data size to controller's maximum I/O size.
   It fixes kernel panic when requested size is too large (0xffffffff).
   
   PR:		kern/136726
 
 Modified:
   stable/7/sys/   (props changed)
   stable/7/sys/contrib/pf/   (props changed)
   stable/7/sys/dev/ata/ata-all.c
 
 Modified: stable/7/sys/dev/ata/ata-all.c
 ==============================================================================
 --- stable/7/sys/dev/ata/ata-all.c	Thu Jul 30 12:41:19 2009	(r195972)
 +++ stable/7/sys/dev/ata/ata-all.c	Thu Jul 30 13:19:12 2009	(r195973)
 @@ -440,6 +440,7 @@ int
  ata_device_ioctl(device_t dev, u_long cmd, caddr_t data)
  {
      struct ata_device *atadev = device_get_softc(dev);
 +    struct ata_channel *ch = device_get_softc(device_get_parent(dev));
      struct ata_ioc_request *ioc_request = (struct ata_ioc_request *)data;
      struct ata_params *params = (struct ata_params *)data;
      int *mode = (int *)data;
 @@ -449,6 +450,10 @@ ata_device_ioctl(device_t dev, u_long cm
  
      switch (cmd) {
      case IOCATAREQUEST:
 +	if (ioc_request->count >
 +	    (ch->dma.max_iosize ? ch->dma.max_iosize : DFLTPHYS)) {
 +		return (EFBIG);
 +	}
  	if (!(buf = malloc(ioc_request->count, M_ATA, M_NOWAIT))) {
  	    return ENOMEM;
  	}
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"