⬢ DragonFlyBSD Kernel Audit
DF-2200 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
diff --git a/sys/dev/netif/ath/ath_hal/ar5312/ar5315_gpio.c b/sys/dev/netif/ath/ath_hal/ar5312/ar5315_gpio.c
--- a/sys/dev/netif/ath/ath_hal/ar5312/ar5315_gpio.c
+++ b/sys/dev/netif/ath/ath_hal/ar5312/ar5315_gpio.c
@@ -40,6 +40,8 @@
 	uint32_t gpioOffset = (AR5315_GPIO_BASE - ((uint32_t) ah->ah_sh));
 
 	HALASSERT(gpio < AR_NUM_GPIO);
+	if (gpio >= AR_NUM_GPIO)
+		return AH_FALSE;
 
 	OS_REG_WRITE(ah, gpioOffset+AR5315_GPIODIR,
 		  (OS_REG_READ(ah, gpioOffset+AR5315_GPIODIR) &~ AR5315_GPIODIR_M(gpio))
@@ -57,6 +59,8 @@
 	uint32_t gpioOffset = (AR5315_GPIO_BASE - ((uint32_t) ah->ah_sh));
 
 	HALASSERT(gpio < AR_NUM_GPIO);
+	if (gpio >= AR_NUM_GPIO)
+		return AH_FALSE;
 
 	OS_REG_WRITE(ah, gpioOffset+AR5315_GPIODIR,
 		  (OS_REG_READ(ah, gpioOffset+AR5315_GPIODIR) &~ AR5315_GPIODIR_M(gpio))
@@ -75,6 +79,8 @@
         uint32_t gpioOffset = (AR5315_GPIO_BASE - ((uint32_t) ah->ah_sh));
 
 	HALASSERT(gpio < AR_NUM_GPIO);
+	if (gpio >= AR_NUM_GPIO)
+		return AH_FALSE;
 
 	reg =  OS_REG_READ(ah, gpioOffset+AR5315_GPIODO);
 	reg &= ~(1 << gpio);
@@ -110,7 +116,8 @@
 	uint32_t val;
 	uint32_t gpioOffset = (AR5315_GPIO_BASE - ((uint32_t) ah->ah_sh));
 
-	/* XXX bounds check gpio */
+	if (gpio >= AR_NUM_GPIO)
+		return;
 	val = OS_REG_READ(ah, gpioOffset+AR5315_GPIOINT);
 	val &= ~(AR5315_GPIOINT_M | AR5315_GPIOINTLVL_M);
 	val |= gpio << AR5315_GPIOINT_S;