⬢ DragonFlyBSD Kernel Audit
DF-3721 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
--- a/sys/dev/netif/mxge/if_mxge.c
+++ b/sys/dev/netif/mxge/if_mxge.c
@@ -456,6 +456,12 @@
 		test = "read";
 		goto abort;
 	}
+	/* repetitions<<16 | ticks: firmware data - never divide by 0 */
+	if ((cmd.data0 & 0xffff) == 0) {
+		test = "read";
+		status = EIO;
+		goto abort;
+	}
 	sc->read_dma = ((cmd.data0>>16) * len * 2) / (cmd.data0 & 0xffff);
 
 	cmd.data0 = MXGE_LOWPART_TO_U32(dmatest_bus);
@@ -466,6 +472,11 @@
 		test = "write";
 		goto abort;
 	}
+	if ((cmd.data0 & 0xffff) == 0) {
+		test = "write";
+		status = EIO;
+		goto abort;
+	}
 	sc->write_dma = ((cmd.data0>>16) * len * 2) / (cmd.data0 & 0xffff);
 
 	cmd.data0 = MXGE_LOWPART_TO_U32(dmatest_bus);
@@ -476,6 +487,11 @@
 		test = "read/write";
 		goto abort;
 	}
+	if ((cmd.data0 & 0xffff) == 0) {
+		test = "read/write";
+		status = EIO;
+		goto abort;
+	}
 	sc->read_write_dma = ((cmd.data0>>16) * len * 2 * 2) /
 	    (cmd.data0 & 0xffff);