DragonFlyBSD Kernel Audit
DF-1774 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/disk/mpt/mpt_user.c b/sys/dev/disk/mpt/mpt_user.c
--- a/sys/dev/disk/mpt/mpt_user.c
+++ b/sys/dev/disk/mpt/mpt_user.c
@@ -192,8 +192,8 @@
 
 	page_mem->vaddr = NULL;
 
-	/* Limit requests to 16M. */
-	if (len > 16 * 1024 * 1024)
+	/* Limit requests to 16M and reject zero-length. */
+	if (len == 0 || len > 16 * 1024 * 1024)
 		return (ENOSPC);
 	error = mpt_dma_tag_create(mpt, mpt->parent_dmat, 1, 0,
 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
@@ -201,7 +201,7 @@
 	if (error)
 		return (error);
 	error = bus_dmamem_alloc(page_mem->tag, &page_mem->vaddr,
-	    BUS_DMA_NOWAIT | BUS_DMA_COHERENT, &page_mem->map);
+	    BUS_DMA_NOWAIT | BUS_DMA_COHERENT | BUS_DMA_ZERO, &page_mem->map);
 	if (error) {
 		bus_dma_tag_destroy(page_mem->tag);
 		return (error);