From 4bd0e7cebc111f552d1a4d34123f79549ebc0882 Mon Sep 17 00:00:00 2001
From: rmind <rmind@NetBSD.org>
Date: Mon, 2 Mar 2009 19:28:08 +0000
Subject: [PATCH] fd_copy: fix off-by-one bug in a race condition path and
 assert. Should fix PR/40625.  OK by <ad>.

---
 sys/kern/kern_descrip.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/sys/kern/kern_descrip.c b/sys/kern/kern_descrip.c
index 8da9f47361b4..81ce2ca69b19 100644
--- a/sys/kern/kern_descrip.c
+++ b/sys/kern/kern_descrip.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kern_descrip.c,v 1.185 2008/12/21 09:58:22 ad Exp $	*/
+/*	$NetBSD: kern_descrip.c,v 1.186 2009/03/02 19:28:08 rmind Exp $	*/
 
 /*-
  * Copyright (c) 2008 The NetBSD Foundation, Inc.
@@ -67,7 +67,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_descrip.c,v 1.185 2008/12/21 09:58:22 ad Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_descrip.c,v 1.186 2009/03/02 19:28:08 rmind Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -1284,7 +1284,7 @@ fd_copy(void)
 				i /= 2;
 			}
 			newfdp->fd_ofiles = fd_ofile_alloc(i);
-			KASSERT(i >= NDFILE);
+			KASSERT(i > NDFILE);
 		}
 		if (NDHISLOTS(i) <= NDHISLOTS(NDFILE)) {
 			newfdp->fd_himap = newfdp->fd_dhimap;
@@ -1313,7 +1313,7 @@ fd_copy(void)
 			break;
 		}
 		mutex_exit(&fdp->fd_lock);
-		if (i >= NDFILE) {
+		if (i > NDFILE) {
 			fd_ofile_free(i, newfdp->fd_ofiles);
 		}
 		if (NDHISLOTS(i) > NDHISLOTS(NDFILE)) {