svn commit: r288255 - head/sys/dev/otus
Adrian Chadd
adrian at FreeBSD.org
Sat Sep 26 07:14:01 UTC 2015
Author: adrian
Date: Sat Sep 26 07:14:00 2015
New Revision: 288255
URL: https://svnweb.freebsd.org/changeset/base/288255
Log:
Fix a bug in the TX command handling - log when a too-large payload is
sent, and fix a bug I found when doing so.
Modified:
head/sys/dev/otus/if_otus.c
Modified: head/sys/dev/otus/if_otus.c
==============================================================================
--- head/sys/dev/otus/if_otus.c Sat Sep 26 07:09:46 2015 (r288254)
+++ head/sys/dev/otus/if_otus.c Sat Sep 26 07:14:00 2015 (r288255)
@@ -1292,6 +1292,14 @@ otus_cmd(struct otus_softc *sc, uint8_t
/* Always bulk-out a multiple of 4 bytes. */
xferlen = (sizeof (*hdr) + ilen + 3) & ~3;
+ if (xferlen > OTUS_MAX_TXCMDSZ) {
+ device_printf(sc->sc_dev, "%s: command (0x%02x) size (%d) > %d\n",
+ __func__,
+ code,
+ xferlen,
+ OTUS_MAX_TXCMDSZ);
+ return (EIO);
+ }
cmd = otus_get_txcmd(sc);
if (cmd == NULL) {
@@ -1346,7 +1354,7 @@ otus_write(struct otus_softc *sc, uint32
sc->write_buf[sc->write_idx].reg = htole32(reg);
sc->write_buf[sc->write_idx].val = htole32(val);
- if (++sc->write_idx > AR_MAX_WRITE_IDX)
+ if (++sc->write_idx > (AR_MAX_WRITE_IDX-1))
(void)otus_write_barrier(sc);
}
More information about the svn-src-all
mailing list