[src/trunk]: src/sys/dev/usb Fix the range check for a single TD maximum tran...

[skrll <skrll%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/734f6a3bf3c3
branches:  trunk
changeset: 821266:734f6a3bf3c3
user:      skrll <skrll%NetBSD.org@localhost>
date:      Mon Jan 30 21:27:19 2017 +0000

description:
Fix the range check for a single TD maximum transfer length

kern/51528 usb_mem.c panic triggered by mounting USB pen drive

diffstat:

 sys/dev/usb/ohci.c |  6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diffs (27 lines):

diff -r 288e6334aa3b -r 734f6a3bf3c3 sys/dev/usb/ohci.c
--- a/sys/dev/usb/ohci.c        Mon Jan 30 21:24:33 2017 +0000
+++ b/sys/dev/usb/ohci.c        Mon Jan 30 21:27:19 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ohci.c,v 1.265 2016/12/04 10:12:35 skrll Exp $ */
+/*     $NetBSD: ohci.c,v 1.266 2017/01/30 21:27:19 skrll Exp $ */
 
 /*
  * Copyright (c) 1998, 2004, 2005, 2012 The NetBSD Foundation, Inc.
@@ -41,7 +41,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ohci.c,v 1.265 2016/12/04 10:12:35 skrll Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ohci.c,v 1.266 2017/01/30 21:27:19 skrll Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
@@ -632,7 +632,7 @@
                 * crossing per TD
                 */
                curlen = len;
-               if (!(sphyspg == ephyspg || sphyspg + 1 == ephyspg)) {
+               if (!(sphyspg == ephyspg || sphyspg + OHCI_PAGE_SIZE == ephyspg)) {
                        /* must use multiple TDs, fill as much as possible. */
                        curlen = 2 * OHCI_PAGE_SIZE -
                            (sdataphys & (OHCI_PAGE_SIZE - 1));