From owner-svn-src-all@freebsd.org Sat Oct 12 23:16:18 2019 Return-Path: Delivered-To: svn-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id AC114150A3A; Sat, 12 Oct 2019 23:16:18 +0000 (UTC) (envelope-from bdragon@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 46rLKt47NHz3DCN; Sat, 12 Oct 2019 23:16:18 +0000 (UTC) (envelope-from bdragon@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 6DC92ACF6; Sat, 12 Oct 2019 23:16:18 +0000 (UTC) (envelope-from bdragon@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id x9CNGIsQ073384; Sat, 12 Oct 2019 23:16:18 GMT (envelope-from bdragon@FreeBSD.org) Received: (from bdragon@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id x9CNGIjK073383; Sat, 12 Oct 2019 23:16:18 GMT (envelope-from bdragon@FreeBSD.org) Message-Id: <201910122316.x9CNGIjK073383@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: bdragon set sender to bdragon@FreeBSD.org using -f From: Brandon Bergren Date: Sat, 12 Oct 2019 23:16:18 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r353459 - head/sys/contrib/ncsw/user/env X-SVN-Group: head X-SVN-Commit-Author: bdragon X-SVN-Commit-Paths: head/sys/contrib/ncsw/user/env X-SVN-Commit-Revision: 353459 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 12 Oct 2019 23:16:18 -0000 Author: bdragon Date: Sat Oct 12 23:16:17 2019 New Revision: 353459 URL: https://svnweb.freebsd.org/changeset/base/353459 Log: Fix read past end of struct in ncsw glue code. The logic in XX_IsPortalIntr() was reading past the end of XX_PInfo. This was causing it to erroneously return 1 instead of 0 in some circumstances, causing a panic on the AmigaOne X5000 due to mixing exclusive and nonexclusive interrupts on the same interrupt line. Since this code is only called a couple of times during startup, use a simple double loop instead of the complex read-ahead single loop. This also fixes a bug where it would never check cpu=0 on type=1. Approved by: jhibbits (mentor) Differential Revision: https://reviews.freebsd.org/D21988 Modified: head/sys/contrib/ncsw/user/env/xx.c Modified: head/sys/contrib/ncsw/user/env/xx.c ============================================================================== --- head/sys/contrib/ncsw/user/env/xx.c Sat Oct 12 23:01:16 2019 (r353458) +++ head/sys/contrib/ncsw/user/env/xx.c Sat Oct 12 23:16:17 2019 (r353459) @@ -288,16 +288,10 @@ XX_IsPortalIntr(uintptr_t irq) { int cpu, type; /* Check interrupt numbers of all available portals */ - for (cpu = 0, type = 0; XX_PInfo.portal_intr[type][cpu] != 0; cpu++) { - if (irq == XX_PInfo.portal_intr[type][cpu]) { - /* Found it! */ - return (1); - } - if (XX_PInfo.portal_intr[type][cpu + 1] == 0) { - type++; - cpu = 0; - } - } + for (type = 0; type < 2; type++) + for (cpu = 0; cpu < MAXCPU; cpu++) + if (irq == XX_PInfo.portal_intr[type][cpu]) + return (1); return (0); }