diff options
| author | tmm <tmm@FreeBSD.org> | 2001-07-29 21:01:13 +0000 |
|---|---|---|
| committer | tmm <tmm@FreeBSD.org> | 2001-07-29 21:01:13 +0000 |
| commit | 15b6c360f7f4a7b51164181d9df88801fc1e9256 (patch) | |
| tree | 0ad6965063ec24a37679d9b7483ff3287799fd0d /sys | |
| parent | 6b3146187fdc1c90923517f5472877524da924d3 (diff) | |
| download | FreeBSD-src-15b6c360f7f4a7b51164181d9df88801fc1e9256.zip FreeBSD-src-15b6c360f7f4a7b51164181d9df88801fc1e9256.tar.gz | |
Disallow ATAPI CD transfers that are not a multiple of the device block
size (previously, the transfer size would be rounded up to a multiple of
the block size, which would overflow the buffer).
This fixes panics when doing things like trying to mount audio CD's.
PR: kern/21946
Review Timeout: sos
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/dev/ata/atapi-cd.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/sys/dev/ata/atapi-cd.c b/sys/dev/ata/atapi-cd.c index da0ce21..89abf69 100644 --- a/sys/dev/ata/atapi-cd.c +++ b/sys/dev/ata/atapi-cd.c @@ -1132,7 +1132,11 @@ acd_start(struct atapi_softc *atp) lastlba = cdp->disk_size; } - count = (bp->bio_bcount + (blocksize - 1)) / blocksize; + if (bp->bio_bcount % blocksize != 0) { + biofinish(bp, NULL, EINVAL); + return; + } + count = bp->bio_bcount / blocksize; if (bp->bio_cmd == BIO_READ) { /* if transfer goes beyond range adjust it to be within limits */ |
