Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

In rtw_{rx,tx}ring_fixup, do not set the tx/rx ring index to 

something out of bounds if we read an invalid pointer form the
hardware.  Prevents a panic when an rtw@cardbus is ejected.
This commit is contained in:
dyoung 2006-02-04 23:22:27 +00:00
parent 979954f179
commit e46f0f4008
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
sys/dev/ic/rtw.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: rtw.c,v 1.64 2005/12/29 22:27:17 dyoung Exp $ */
/* $NetBSD: rtw.c,v 1.65 2006/02/04 23:22:27 dyoung Exp $ */
/*-
* Copyright (c) 2004, 2005 David Young. All rights reserved.
*
@ -34,7 +34,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: rtw.c,v 1.64 2005/12/29 22:27:17 dyoung Exp $");
__KERNEL_RCSID(0, "$NetBSD: rtw.c,v 1.65 2006/02/04 23:22:27 dyoung Exp $");
#include "bpfilter.h"
@ -1993,7 +1993,7 @@ rtw_txring_fixup(struct rtw_softc *sc)
continue;
printf("%s: tx-ring %d expected next %u, read %u\n", __func__,
pri, tdb->tdb_next, next);
tdb->tdb_next = next;
tdb->tdb_next = MIN(next, tdb->tdb_ndesc - 1);
}
}
@ -2011,7 +2011,7 @@ rtw_rxring_fixup(struct rtw_softc *sc)
if (rdb->rdb_next != next) {
printf("%s: rx-ring expected next %u, read %u\n", __func__,
rdb->rdb_next, next);
rdb->rdb_next = next;
rdb->rdb_next = MIN(next, rdb->rdb_ndesc - 1);
}
}