From owner-svn-src-user@FreeBSD.ORG Tue Sep 21 18:25:34 2010 Return-Path: Delivered-To: svn-src-user@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 516301065679; Tue, 21 Sep 2010 18:25:34 +0000 (UTC) (envelope-from weongyo@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 40DD78FC18; Tue, 21 Sep 2010 18:25:34 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id o8LIPYwu002643; Tue, 21 Sep 2010 18:25:34 GMT (envelope-from weongyo@svn.freebsd.org) Received: (from weongyo@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id o8LIPYwV002641; Tue, 21 Sep 2010 18:25:34 GMT (envelope-from weongyo@svn.freebsd.org) Message-Id: <201009211825.o8LIPYwV002641@svn.freebsd.org> From: Weongyo Jeong Date: Tue, 21 Sep 2010 18:25:34 +0000 (UTC) To: src-committers@freebsd.org, svn-src-user@freebsd.org X-SVN-Group: user MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r212973 - user/weongyo/usb/sys/dev/usb X-BeenThere: svn-src-user@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the experimental " user" src tree" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Sep 2010 18:25:34 -0000 Author: weongyo Date: Tue Sep 21 18:25:33 2010 New Revision: 212973 URL: http://svn.freebsd.org/changeset/base/212973 Log: Checks the requested size whether it's over INT_MAX or not. If it's over explicitly make a panic. Most of cases the size would be less than 128 Kbytes (even if it's a worst case it'll be smaller than 1 Mbytes) because the buffer is for DMA operations. So if it's larger than 2G it means the driver writer did something wrong. Pointed by: imp Modified: user/weongyo/usb/sys/dev/usb/usb_busdma.c Modified: user/weongyo/usb/sys/dev/usb/usb_busdma.c ============================================================================== --- user/weongyo/usb/sys/dev/usb/usb_busdma.c Tue Sep 21 17:52:32 2010 (r212972) +++ user/weongyo/usb/sys/dev/usb/usb_busdma.c Tue Sep 21 18:25:33 2010 (r212973) @@ -34,6 +34,7 @@ #include #include #include +#include #include #include #include @@ -475,6 +476,12 @@ usb_pc_alloc_mem(struct usb_page_cache * uptag = pc->tag_parent; + /* + * Checks the requested size first before allocating DMA-able buffer + * that if the size is over 2G the alignment value could be overflowed. + */ + if (size >= INT_MAX) + panic("too big size (%d) for DMA-able buffer", size); if (align == 0) goto error; if (align != 1) {