[src/trunk]: src/sys/dev/i2o Fix a buffer pointer check in iop_msg_unmap(). T...

[msaitoh <msaitoh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/566004b42dda
branches:  trunk
changeset: 810047:566004b42dda
user:      msaitoh <msaitoh%NetBSD.org@localhost>
date:      Sun Aug 16 19:21:33 2015 +0000

description:
Fix a buffer pointer check in iop_msg_unmap(). The number of im_xfer
is IOP_MAX_MSG_XFERS and it's three. iop_systab_set() makes three ximit
buffers. In this case, iop_msg_unmap() overrruns by "if((++ix)->ix_size == 0)".
Check overrun first.

 This change fixes a bug that iop(4) panics while attaching iopsp(4).

diffstat:

 sys/dev/i2o/iop.c |  8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diffs (30 lines):

diff -r a489e84d29b8 -r 566004b42dda sys/dev/i2o/iop.c
--- a/sys/dev/i2o/iop.c Sun Aug 16 18:00:03 2015 +0000
+++ b/sys/dev/i2o/iop.c Sun Aug 16 19:21:33 2015 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: iop.c,v 1.86 2014/07/25 08:10:37 dholland Exp $        */
+/*     $NetBSD: iop.c,v 1.87 2015/08/16 19:21:33 msaitoh Exp $ */
 
 /*-
  * Copyright (c) 2000, 2001, 2002, 2007 The NetBSD Foundation, Inc.
@@ -34,7 +34,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: iop.c,v 1.86 2014/07/25 08:10:37 dholland Exp $");
+__KERNEL_RCSID(0, "$NetBSD: iop.c,v 1.87 2015/08/16 19:21:33 msaitoh Exp $");
 
 #include "iop.h"
 
@@ -2088,9 +2088,9 @@
                /* Only the first DMA map is static. */
                if (i != 0)
                        bus_dmamap_destroy(sc->sc_dmat, ix->ix_map);
-               if ((++ix)->ix_size == 0)
+               if (++i >= IOP_MAX_MSG_XFERS)
                        break;
-               if (++i >= IOP_MAX_MSG_XFERS)
+               if ((++ix)->ix_size == 0)
                        break;
        }
 }