Date: Sat, 26 Sep 2015 07:14:00 +0000 (UTC) From: Adrian Chadd <adrian@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r288255 - head/sys/dev/otus Message-ID: <201509260714.t8Q7E0jS011788@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: adrian Date: Sat Sep 26 07:14:00 2015 New Revision: 288255 URL: https://svnweb.freebsd.org/changeset/base/288255 Log: Fix a bug in the TX command handling - log when a too-large payload is sent, and fix a bug I found when doing so. Modified: head/sys/dev/otus/if_otus.c Modified: head/sys/dev/otus/if_otus.c ============================================================================== --- head/sys/dev/otus/if_otus.c Sat Sep 26 07:09:46 2015 (r288254) +++ head/sys/dev/otus/if_otus.c Sat Sep 26 07:14:00 2015 (r288255) @@ -1292,6 +1292,14 @@ otus_cmd(struct otus_softc *sc, uint8_t /* Always bulk-out a multiple of 4 bytes. */ xferlen = (sizeof (*hdr) + ilen + 3) & ~3; + if (xferlen > OTUS_MAX_TXCMDSZ) { + device_printf(sc->sc_dev, "%s: command (0x%02x) size (%d) > %d\n", + __func__, + code, + xferlen, + OTUS_MAX_TXCMDSZ); + return (EIO); + } cmd = otus_get_txcmd(sc); if (cmd == NULL) { @@ -1346,7 +1354,7 @@ otus_write(struct otus_softc *sc, uint32 sc->write_buf[sc->write_idx].reg = htole32(reg); sc->write_buf[sc->write_idx].val = htole32(val); - if (++sc->write_idx > AR_MAX_WRITE_IDX) + if (++sc->write_idx > (AR_MAX_WRITE_IDX-1)) (void)otus_write_barrier(sc); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201509260714.t8Q7E0jS011788>