From owner-freebsd-bugs  Wed Mar  6 05:20:05 1996
Return-Path: owner-bugs
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.3/8.7.3) id FAA19648
          for bugs-outgoing; Wed, 6 Mar 1996 05:20:05 -0800 (PST)
Received: (from gnats@localhost)
          by freefall.freebsd.org (8.7.3/8.7.3) id FAA19626
          Wed, 6 Mar 1996 05:20:03 -0800 (PST)
Resent-Date: Wed, 6 Mar 1996 05:20:03 -0800 (PST)
Resent-Message-Id: <199603061320.FAA19626@freefall.freebsd.org>
Resent-From: gnats (GNATS Management)
Resent-To: freebsd-bugs
Resent-Reply-To: FreeBSD-gnats@freefall.FreeBSD.org, vak@crox.net.kiae.su
Received: from crox.net.kiae.su (crox.net.kiae.su [144.206.130.72])
          by freefall.freebsd.org (8.7.3/8.7.3) with SMTP id FAA19208
          for <FreeBSD-gnats-submit@freebsd.org>; Wed, 6 Mar 1996 05:10:40 -0800 (PST)
Received: by crox.net.kiae.su id QAA00489;
  (8.6.12/vak/1.8a) Wed, 6 Mar 1996 16:10:56 +0300
Message-Id: <199603061310.QAA00489@crox.net.kiae.su>
Date: Wed, 6 Mar 1996 16:10:56 +0300
From: vak@crox.net.kiae.su (Serge V.Vakulenko)
Reply-To: vak@crox.net.kiae.su
To: FreeBSD-gnats-submit@freebsd.org
X-Send-Pr-Version: 3.2
Subject: kern/1065: patch for wt driver
Sender: owner-bugs@freebsd.org
Precedence: bulk


>Number:         1065
>Category:       kern
>Synopsis:       wt could crash reading short blocks
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Mar  6 05:20:01 PST 1996
>Last-Modified:
>Originator:     Serge V.Vakulenko
>Organization:
Cronyx Ltd., Moscow
>Release:        FreeBSD 2.1-STABLE i386
>Environment:

	FreeBSD 2.1 and Archive tape streamer

>Description:

	The system crashes when trying to read the tape
	using small block size (less than 2048 bytes).

>How-To-Repeat:

	dd bs=1 < /dev/rwt0 > /dev/null

>Fix:
	
--- wt21.c	Thu Sep 14 11:09:39 1995
+++ wt.c	Wed Mar  6 15:41:49 1996
@@ -634,8 +634,6 @@
 		DEBUG (("unexpected interrupt\n"));
 		return;
 	}
-	t->flags &= ~TPACTIVE;
-	t->dmacount += t->bsize;                /* increment counter */
 
 	/*
 	 * Clean up dma.
@@ -648,6 +646,10 @@
 	} else
 		isa_dmadone (t->dmaflags, t->dmavaddr, t->bsize, t->chan);
 
+	t->flags &= ~TPACTIVE;
+	t->dmacount += t->bsize;
+	t->dmavaddr += t->bsize;
+
 	/*
 	 * On exception, check for end of file and end of volume.
 	 */
@@ -663,7 +665,6 @@
 	}
 
 	if (t->dmacount < t->dmatotal) {        /* continue i/o */
-		t->dmavaddr += t->bsize;
 		wtdma (t);
 		DEBUG (("continue i/o, %d\n", t->dmacount));
 		return;

>Audit-Trail:
>Unformatted: