⬢ DragonFlyBSD Kernel Audit
DF-5302 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
--- a/sys/bus/firewire/fwohci.c
+++ b/sys/bus/firewire/fwohci.c
@@ -1187,6 +1187,11 @@ fwohci_db_init(struct fwohci_softc *sc, struct fwohci_dbch *dbch)
 	if ((dbch->flags & FWOHCI_DBCH_INIT) != 0)
 		goto out;
 
+	if (dbch->ndb == 0) {
+		/* invalid ring: never dereference an empty db_trq */
+		return;
+	}
+
 	/* create dma_tag for buffers */
 #define MAX_REQCOUNT	0xffff
 	if (bus_dma_tag_create(/*parent*/ sc->fc.dmat,
@@ -1484,6 +1489,12 @@ fwohci_itxbuf_enable(struct firewire_comm *fc, int dmach)
 	if ((dbch->flags & FWOHCI_DBCH_INIT) == 0) {
 		dbch->ndb = it->bnpacket * it->bnchunk;
 		dbch->ndesc = 3;
+		if (dbch->ndb == 0) {
+			kprintf("fwohci: invalid iso tx buffer spec "
+			    "(bnpacket=%u bnchunk=%u)\n",
+			    it->bnpacket, it->bnchunk);
+			return (EINVAL);
+		}
 		fwohci_db_init(sc, dbch);
 		if ((dbch->flags & FWOHCI_DBCH_INIT) == 0)
 			return ENOMEM;
@@ -1605,6 +1616,12 @@ fwohci_irx_enable(struct firewire_comm *fc, int dmach)
 		ir->queued = 0;
 		dbch->ndb = ir->bnpacket * ir->bnchunk;
 		dbch->ndesc = 2;
+		if (dbch->ndb == 0) {
+			kprintf("fwohci: invalid iso rx buffer spec "
+			    "(bnpacket=%u bnchunk=%u)\n",
+			    ir->bnpacket, ir->bnchunk);
+			return (EINVAL);
+		}
 		fwohci_db_init(sc, dbch);
 		if ((dbch->flags & FWOHCI_DBCH_INIT) == 0)
 			return ENOMEM;