Date: Wed, 22 Oct 2014 01:37:33 +0000 (UTC) From: Marcel Moolenaar <marcel@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r273446 - head/sys/x86/isa Message-ID: <201410220137.s9M1bXuh023209@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: marcel Date: Wed Oct 22 01:37:32 2014 New Revision: 273446 URL: https://svnweb.freebsd.org/changeset/base/273446 Log: Virtual machines can easily have more than 16 option ROMs and when that happens, we happily access our resource array out of bounds. Make sure we stay within the MAX_ROMS limit. While here, bump MAX_ROMS from 16 to 32 to minimize the chance of leaving option ROMs unaccounted for. Obtained from: Juniper Networks, Inc. Modified: head/sys/x86/isa/orm.c Modified: head/sys/x86/isa/orm.c ============================================================================== --- head/sys/x86/isa/orm.c Wed Oct 22 01:35:30 2014 (r273445) +++ head/sys/x86/isa/orm.c Wed Oct 22 01:37:32 2014 (r273446) @@ -58,7 +58,7 @@ static struct isa_pnp_id orm_ids[] = { { 0, NULL }, }; -#define MAX_ROMS 16 +#define MAX_ROMS 32 struct orm_softc { int rnum; @@ -97,7 +97,7 @@ orm_identify(driver_t* driver, device_t isa_set_vendorid(child, ORM_ID); sc = device_get_softc(child); sc->rnum = 0; - while (chunk < IOMEM_END) { + while (sc->rnum < MAX_ROMS && chunk < IOMEM_END) { bus_set_resource(child, SYS_RES_MEMORY, sc->rnum, chunk, IOMEM_STEP); rid = sc->rnum;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201410220137.s9M1bXuh023209>