vndthread: fix an integer overflow. fix a panic reported by Simon Burge.
This commit is contained in:
parent
9e261d2477
commit
e31143d772
|
@ -1,4 +1,4 @@
|
||||||
/* $NetBSD: vnd.c,v 1.139 2006/02/04 13:38:04 yamt Exp $ */
|
/* $NetBSD: vnd.c,v 1.140 2006/02/04 13:40:38 yamt Exp $ */
|
||||||
|
|
||||||
/*-
|
/*-
|
||||||
* Copyright (c) 1996, 1997, 1998 The NetBSD Foundation, Inc.
|
* Copyright (c) 1996, 1997, 1998 The NetBSD Foundation, Inc.
|
||||||
|
@ -133,7 +133,7 @@
|
||||||
*/
|
*/
|
||||||
|
|
||||||
#include <sys/cdefs.h>
|
#include <sys/cdefs.h>
|
||||||
__KERNEL_RCSID(0, "$NetBSD: vnd.c,v 1.139 2006/02/04 13:38:04 yamt Exp $");
|
__KERNEL_RCSID(0, "$NetBSD: vnd.c,v 1.140 2006/02/04 13:40:38 yamt Exp $");
|
||||||
|
|
||||||
#if defined(_KERNEL_OPT)
|
#if defined(_KERNEL_OPT)
|
||||||
#include "fs_nfs.h"
|
#include "fs_nfs.h"
|
||||||
|
@ -652,12 +652,8 @@ vndthread(void *arg)
|
||||||
nra = 0;
|
nra = 0;
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
if ((off = bn % bsize) != 0)
|
off = bn % bsize;
|
||||||
sz = bsize - off;
|
sz = MIN(((off_t)1 + nra) * bsize - off, resid);
|
||||||
else
|
|
||||||
sz = (1 + nra) * bsize;
|
|
||||||
if (resid < sz)
|
|
||||||
sz = resid;
|
|
||||||
#ifdef DEBUG
|
#ifdef DEBUG
|
||||||
if (vnddebug & VDB_IO)
|
if (vnddebug & VDB_IO)
|
||||||
printf("vndstrategy: vp %p/%p bn 0x%qx/0x%" PRIx64
|
printf("vndstrategy: vp %p/%p bn 0x%qx/0x%" PRIx64
|
||||||
|
|
Loading…
Reference in New Issue