From e31143d772ad67f8489e50e80de74f56661e41ca Mon Sep 17 00:00:00 2001
From: yamt <yamt@NetBSD.org>
Date: Sat, 4 Feb 2006 13:40:38 +0000
Subject: [PATCH] vndthread: fix an integer overflow.  fix a panic reported by
 Simon Burge.

---
 sys/dev/vnd.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/sys/dev/vnd.c b/sys/dev/vnd.c
index c57a1cfa665d..38cfebd16bed 100644
--- a/sys/dev/vnd.c
+++ b/sys/dev/vnd.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: vnd.c,v 1.139 2006/02/04 13:38:04 yamt Exp $	*/
+/*	$NetBSD: vnd.c,v 1.140 2006/02/04 13:40:38 yamt Exp $	*/
 
 /*-
  * Copyright (c) 1996, 1997, 1998 The NetBSD Foundation, Inc.
@@ -133,7 +133,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: vnd.c,v 1.139 2006/02/04 13:38:04 yamt Exp $");
+__KERNEL_RCSID(0, "$NetBSD: vnd.c,v 1.140 2006/02/04 13:40:38 yamt Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "fs_nfs.h"
@@ -652,12 +652,8 @@ vndthread(void *arg)
 				nra = 0;
 #endif
 
-			if ((off = bn % bsize) != 0)
-				sz = bsize - off;
-			else
-				sz = (1 + nra) * bsize;
-			if (resid < sz)
-				sz = resid;
+			off = bn % bsize;
+			sz = MIN(((off_t)1 + nra) * bsize - off, resid);
 #ifdef	DEBUG
 			if (vnddebug & VDB_IO)
 				printf("vndstrategy: vp %p/%p bn 0x%qx/0x%" PRIx64