Module Name: src
Committed By: msaitoh
Date: Sun Aug 16 19:21:33 UTC 2015
Modified Files:
src/sys/dev/i2o: iop.c
Log Message:
Fix a buffer pointer check in iop_msg_unmap(). The number of im_xfer
is IOP_MAX_MSG_XFERS and it's three. iop_systab_set() makes three ximit
buffers. In this case, iop_msg_unmap() overrruns by "if((++ix)->ix_size == 0)".
Check overrun first.
This change fixes a bug that iop(4) panics while attaching iopsp(4).
To generate a diff of this commit:
cvs rdiff -u -r1.86 -r1.87 src/sys/dev/i2o/iop.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
