misc/122195: Alignment problems in if_ed

[Christian Kandeler]

>Number:         122195
>Category:       misc
>Synopsis:       Alignment problems in if_ed
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Mar 28 15:00:00 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Christian Kandeler
>Release:        7.0
>Organization:
HOB
>Environment:
>Description:
Function ed_pio_write_mbufs() in sys/dev/ed/if_ed.c has at least two alignment problems:
    1) The savebyte array is cast to an unsigned short pointer and then dereferenced, but since it is a character array, it may not be suitably aligned.
    2) The call to ed_asic_outsw() assumes that the data pointer can be dereferenced as an unsigned short, but I don't think there is any guarantee that it fulfills the alignment requirements.
>How-To-Repeat:

>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: