The following reply was made to PR kern/112670; it has been noted by GNATS.
From: Ariff Abdullah <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED], [EMAIL PROTECTED]
Cc:
Subject: Re: kern/112670: [if_tap] stat /dev/tapN leads to panic for N >= 2G
Date: Thu, 17 May 2007 05:33:48 +0800
This is a multi-part message in MIME format.
--Multipart=_Thu__17_May_2007_05_33_48_+0800_IlHONeq=l+xq7q9C
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Grr... this was meant for kern/112670, not 112671. Sorry.
Well, I'm not really sure if this is all about signess or simply
because dev_stdclone() itself fail to do correct checking on
unit > 0xffffff (it should be CLONE_UNITMASK which is 0xfffff, no?),
obviously an overflow against clone_create(). It could be argued that
the caller would later strip and truncate it, but there are few other
drivers (notably snp(4)) which innocently proceed without any
tinkering.
Anyway, try this patch. It should help other dev_stdclone() users too.
--
Ariff Abdullah
FreeBSD
... Recording in stereo is obviously too advanced
and confusing for us idiot ***** users :P ........
--Multipart=_Thu__17_May_2007_05_33_48_+0800_IlHONeq=l+xq7q9C
Content-Type: text/x-diff;
name="kern_conf.c.diff"
Content-Disposition: attachment;
filename="kern_conf.c.diff"
Content-Transfer-Encoding: 7bit
Index: src/sys/kern/kern_conf.c
===================================================================
RCS file: /home/ncvs/src/sys/kern/kern_conf.c,v
retrieving revision 1.201
diff -u -r1.201 kern_conf.c
--- src/sys/kern/kern_conf.c 2 Feb 2007 22:27:45 -0000 1.201
+++ src/sys/kern/kern_conf.c 16 May 2007 20:05:51 -0000
@@ -763,7 +763,7 @@
u *= 10;
u += name[i++] - '0';
}
- if (u > 0xffffff)
+ if (u > CLONE_UNITMASK)
return (0);
*unit = u;
if (namep)
--Multipart=_Thu__17_May_2007_05_33_48_+0800_IlHONeq=l+xq7q9C--
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
