From owner-freebsd-bugs@FreeBSD.ORG  Thu Jul 16 19:50:05 2009
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 16AA61065675
	for <freebsd-bugs@hub.freebsd.org>;
	Thu, 16 Jul 2009 19:50:05 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org
	[IPv6:2001:4f8:fff6::28])
	by mx1.freebsd.org (Postfix) with ESMTP id 049CB8FC1A
	for <freebsd-bugs@hub.freebsd.org>;
	Thu, 16 Jul 2009 19:50:05 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n6GJo4dl005083
	for <freebsd-bugs@freefall.freebsd.org>; Thu, 16 Jul 2009 19:50:04 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n6GJo4as005081;
	Thu, 16 Jul 2009 19:50:04 GMT (envelope-from gnats)
Date: Thu, 16 Jul 2009 19:50:04 GMT
Message-Id: <200907161950.n6GJo4as005081@freefall.freebsd.org>
To: freebsd-bugs@FreeBSD.org
From: dfilter@FreeBSD.ORG (dfilter service)
Cc: 
Subject: Re: kern/136726: commit references a PR
X-BeenThere: freebsd-bugs@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: dfilter service <dfilter@FreeBSD.ORG>
List-Id: Bug reports <freebsd-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-bugs>
List-Post: <mailto:freebsd-bugs@freebsd.org>
List-Help: <mailto:freebsd-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 16 Jul 2009 19:50:06 -0000

The following reply was made to PR kern/136726; it has been noted by GNATS.

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/136726: commit references a PR
Date: Thu, 16 Jul 2009 19:48:53 +0000 (UTC)

 Author: mav
 Date: Thu Jul 16 19:48:39 2009
 New Revision: 195724
 URL: http://svn.freebsd.org/changeset/base/195724
 
 Log:
   Limit IOCATAREQUEST ioctl data size to controller's maximum I/O size.
   It fixes kernel panic when requested size is too large (0xffffffff),
   
   PR:             kern/136726
   Approved by:    re (kib)
   MFC after:      2 weeks
 
 Modified:
   head/sys/dev/ata/ata-all.c
 
 Modified: head/sys/dev/ata/ata-all.c
 ==============================================================================
 --- head/sys/dev/ata/ata-all.c	Thu Jul 16 17:31:23 2009	(r195723)
 +++ head/sys/dev/ata/ata-all.c	Thu Jul 16 19:48:39 2009	(r195724)
 @@ -472,6 +472,7 @@ int
  ata_device_ioctl(device_t dev, u_long cmd, caddr_t data)
  {
      struct ata_device *atadev = device_get_softc(dev);
 +    struct ata_channel *ch = device_get_softc(device_get_parent(dev));
      struct ata_ioc_request *ioc_request = (struct ata_ioc_request *)data;
      struct ata_params *params = (struct ata_params *)data;
      int *mode = (int *)data;
 @@ -481,6 +482,10 @@ ata_device_ioctl(device_t dev, u_long cm
  
      switch (cmd) {
      case IOCATAREQUEST:
 +	if (ioc_request->count >
 +	    (ch->dma.max_iosize ? ch->dma.max_iosize : DFLTPHYS)) {
 +		return (EFBIG);
 +	}
  	if (!(buf = malloc(ioc_request->count, M_ATA, M_NOWAIT))) {
  	    return ENOMEM;
  	}
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"