⬢ DragonFlyBSD Kernel Audit
DF-3963 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
--- a/sys/dev/raid/hptiop/hptiop.c	2026-09-17 06:16:59.056779292 +0000
+++ b/sys/dev/raid/hptiop/hptiop.c	2026-09-17 06:16:59.104778680 +0000
@@ -229,7 +229,8 @@ static int hptiop_ioctl(struct dev_ioctl
 static u_int64_t hptiop_mv_outbound_read(struct hpt_iop_hba *hba)
 {
 	u_int64_t p;
-	u_int32_t outbound_tail = BUS_SPACE_RD4_MV2(outbound_tail);
+	u_int32_t outbound_tail = BUS_SPACE_RD4_MV2(outbound_tail) &
+	    (MVIOP_QUEUE_LEN - 1);
 	u_int32_t outbound_head = BUS_SPACE_RD4_MV2(outbound_head);
 
 	if (outbound_tail != outbound_head) {
@@ -251,7 +252,8 @@ static u_int64_t hptiop_mv_outbound_read
 
 static void hptiop_mv_inbound_write(u_int64_t p, struct hpt_iop_hba *hba)
 {
-	u_int32_t inbound_head = BUS_SPACE_RD4_MV2(inbound_head);
+	u_int32_t inbound_head = BUS_SPACE_RD4_MV2(inbound_head) &
+	    (MVIOP_QUEUE_LEN - 1);
 	u_int32_t head = inbound_head + 1;
 
 	if (head == MVIOP_QUEUE_LEN)