kern/136726: commit references a PR

[dfilter service]

The following reply was made to PR kern/136726; it has been noted by GNATS.

From: dfilter at FreeBSD.ORG (dfilter service)
To: bug-followup at FreeBSD.org
Cc:  
Subject: Re: kern/136726: commit references a PR
Date: Thu, 30 Jul 2009 13:19:28 +0000 (UTC)

 Author: mav
 Date: Thu Jul 30 13:19:12 2009
 New Revision: 195973
 URL: http://svn.freebsd.org/changeset/base/195973
 
 Log:
   MFC rev. 195724:
   
   Limit IOCATAREQUEST ioctl data size to controller's maximum I/O size.
   It fixes kernel panic when requested size is too large (0xffffffff).
   
   PR:		kern/136726
 
 Modified:
   stable/7/sys/   (props changed)
   stable/7/sys/contrib/pf/   (props changed)
   stable/7/sys/dev/ata/ata-all.c
 
 Modified: stable/7/sys/dev/ata/ata-all.c
 ==============================================================================
 --- stable/7/sys/dev/ata/ata-all.c	Thu Jul 30 12:41:19 2009	(r195972)
 +++ stable/7/sys/dev/ata/ata-all.c	Thu Jul 30 13:19:12 2009	(r195973)
 @@ -440,6 +440,7 @@ int
  ata_device_ioctl(device_t dev, u_long cmd, caddr_t data)
  {
      struct ata_device *atadev = device_get_softc(dev);
 +    struct ata_channel *ch = device_get_softc(device_get_parent(dev));
      struct ata_ioc_request *ioc_request = (struct ata_ioc_request *)data;
      struct ata_params *params = (struct ata_params *)data;
      int *mode = (int *)data;
 @@ -449,6 +450,10 @@ ata_device_ioctl(device_t dev, u_long cm
  
      switch (cmd) {
      case IOCATAREQUEST:
 +	if (ioc_request->count >
 +	    (ch->dma.max_iosize ? ch->dma.max_iosize : DFLTPHYS)) {
 +		return (EFBIG);
 +	}
  	if (!(buf = malloc(ioc_request->count, M_ATA, M_NOWAIT))) {
  	    return ENOMEM;
  	}
 _______________________________________________
 svn-src-all at freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe at freebsd.org"