⬢ DragonFlyBSD Kernel Audit
DF-2981 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
--- a/sys/kern/subr_busdma.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/kern/subr_busdma.c	2026-10-26 03:27:38.934321340 +0000
@@ -38,16 +38,24 @@
 #include <sys/mbuf.h>
 #include <sys/malloc.h>
 
+struct bus_dmamem_coherent_arg {
+	bus_addr_t	*addr;
+	int		error;
+};
+
 static void
 _bus_dmamem_coherent_cb(void *arg, bus_dma_segment_t *segs, int nseg, int error)
 {
-	bus_addr_t *addr = arg;
+	struct bus_dmamem_coherent_arg *carg = arg;
 
-	if (error)
+	if (error) {
+		/* propagate the load failure to bus_dmamem_coherent() */
+		carg->error = error;
 		return;
+	}
 
 	KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
-	*addr = segs->ds_addr;
+	*carg->addr = segs->ds_addr;
 }
 
 int
@@ -57,6 +65,7 @@
 		    bus_size_t maxsize, int flags,
 		    bus_dmamem_t *dmem)
 {
+	struct bus_dmamem_coherent_arg carg;
 	int error;
 
 	bzero(dmem, sizeof(*dmem));
@@ -76,10 +85,14 @@
                 return error;
 	}
 
+	carg.addr = &dmem->dmem_busaddr;
+	carg.error = 0;
 	error = bus_dmamap_load(dmem->dmem_tag, dmem->dmem_map,
 				dmem->dmem_addr, maxsize,
-				_bus_dmamem_coherent_cb, &dmem->dmem_busaddr,
+				_bus_dmamem_coherent_cb, &carg,
 				flags & BUS_DMA_NOWAIT);
+	if (error == 0)
+		error = carg.error;	/* synchronous callback error */
 	if (error) {
 		if (error == EINPROGRESS) {
 			panic("DMA coherent memory loading is still "