From owner-svn-src-stable@FreeBSD.ORG  Thu Jan  5 21:18:35 2012
Return-Path: <owner-svn-src-stable@FreeBSD.ORG>
Delivered-To: svn-src-stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 516C51065670;
	Thu,  5 Jan 2012 21:18:35 +0000 (UTC)
	(envelope-from yongari@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c])
	by mx1.freebsd.org (Postfix) with ESMTP id 3F2E98FC12;
	Thu,  5 Jan 2012 21:18:35 +0000 (UTC)
Received: from svn.freebsd.org (localhost [127.0.0.1])
	by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id q05LIZv0056006;
	Thu, 5 Jan 2012 21:18:35 GMT (envelope-from yongari@svn.freebsd.org)
Received: (from yongari@localhost)
	by svn.freebsd.org (8.14.4/8.14.4/Submit) id q05LIZCV056004;
	Thu, 5 Jan 2012 21:18:35 GMT (envelope-from yongari@svn.freebsd.org)
Message-Id: <201201052118.q05LIZCV056004@svn.freebsd.org>
From: Pyun YongHyeon <yongari@FreeBSD.org>
Date: Thu, 5 Jan 2012 21:18:35 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
	svn-src-stable@freebsd.org, svn-src-stable-7@freebsd.org
X-SVN-Group: stable-7
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Cc: 
Subject: svn commit: r229650 - stable/7/sys/dev/ed
X-BeenThere: svn-src-stable@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: SVN commit messages for all the -stable branches of the src tree
	<svn-src-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-stable>, 
	<mailto:svn-src-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-stable>
List-Post: <mailto:svn-src-stable@freebsd.org>
List-Help: <mailto:svn-src-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-stable>,
	<mailto:svn-src-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 05 Jan 2012 21:18:35 -0000

Author: yongari
Date: Thu Jan  5 21:18:34 2012
New Revision: 229650
URL: http://svn.freebsd.org/changeset/base/229650

Log:
  MFC r228286:
    Fix off by one error in mbuf access.  Previously it caused panic.
    While I'm here use NULL to compare mbuf pointer and add additional
    check for zero length mbuf before accessing the mbuf.
  
    PR:	kern/162932

Modified:
  stable/7/sys/dev/ed/if_ed.c
Directory Properties:
  stable/7/sys/   (props changed)
  stable/7/sys/cddl/contrib/opensolaris/   (props changed)
  stable/7/sys/contrib/dev/acpica/   (props changed)
  stable/7/sys/contrib/pf/   (props changed)

Modified: stable/7/sys/dev/ed/if_ed.c
==============================================================================
--- stable/7/sys/dev/ed/if_ed.c	Thu Jan  5 21:17:06 2012	(r229649)
+++ stable/7/sys/dev/ed/if_ed.c	Thu Jan  5 21:18:34 2012	(r229650)
@@ -1689,12 +1689,19 @@ ed_shmem_write_mbufs(struct ed_softc *sc
 			break;
 		}
 	}
-	for (len = 0; m != 0; m = m->m_next) {
-		if (sc->isa16bit)
-			bus_space_write_region_2(sc->mem_bst,
-			    sc->mem_bsh, dst,
-			    mtod(m, uint16_t *), (m->m_len + 1)/ 2);
-		else
+	for (len = 0; m != NULL; m = m->m_next) {
+		if (m->m_len == 0)
+			continue;
+		if (sc->isa16bit) {
+			if (m->m_len > 1)
+				bus_space_write_region_2(sc->mem_bst,
+				    sc->mem_bsh, dst,
+				    mtod(m, uint16_t *), m->m_len / 2);
+			if ((m->m_len & 1) != 0)
+				bus_space_write_1(sc->mem_bst, sc->mem_bsh,
+				    dst + m->m_len - 1,
+				    *(mtod(m, uint8_t *) + m->m_len - 1));
+		} else
 			bus_space_write_region_1(sc->mem_bst,
 			    sc->mem_bsh, dst,
 			    mtod(m, uint8_t *), m->m_len);