1 files changed, 18 insertions, 11 deletions

diff --git a/sys/pci/nfsmb.c b/sys/pci/nfsmb.c
index 5cd1b08..1511121 100644
--- a/sys/pci/nfsmb.c
+++ b/sys/pci/nfsmb.c
@@ -252,7 +252,7 @@ nfsmb_detach(device_t dev)
 }
 
 static int
-nfsmb_callback(device_t dev, int index, caddr_t *data)
+nfsmb_callback(device_t dev, int index, void *data)
 {
 	int error = 0;
 
@@ -456,13 +456,14 @@ static int
 nfsmb_bwrite(device_t dev, u_char slave, char cmd, u_char count, char *buf)
 {
 	struct nfsmb_softc *sc = (struct nfsmb_softc *)device_get_softc(dev);
-	u_char len, i;
+	u_char i;
 	int error;
 
-	len = min(count, 32);
+	if (count < 1 || count > 32)
+		return (SMB_EINVAL);
 	NFSMB_SMBOUTB(sc, SMB_CMD, cmd);
-	NFSMB_SMBOUTB(sc, SMB_BCNT, len);
-	for (i = 0; i < len; i++)
+	NFSMB_SMBOUTB(sc, SMB_BCNT, count);
+	for (i = 0; i < count; i++)
 		NFSMB_SMBOUTB(sc, SMB_DATA + i, buf[i]);
 	NFSMB_SMBOUTB(sc, SMB_ADDR, slave);
 	NFSMB_SMBOUTB(sc, SMB_PRTCL, SMB_PRTCL_WRITE | SMB_PRTCL_BLOCK_DATA);
@@ -475,24 +476,29 @@ nfsmb_bwrite(device_t dev, u_char slave, char cmd, u_char count, char *buf)
 }
 
 static int
-nfsmb_bread(device_t dev, u_char slave, char cmd, u_char count, char *buf)
+nfsmb_bread(device_t dev, u_char slave, char cmd, u_char *count, char *buf)
 {
 	struct nfsmb_softc *sc = (struct nfsmb_softc *)device_get_softc(dev);
-	u_char len, i;
+	u_char data, len, i;
 	int error;
 
+	if (*count < 1 || *count > 32)
+		return (SMB_EINVAL);
 	NFSMB_SMBOUTB(sc, SMB_CMD, cmd);
 	NFSMB_SMBOUTB(sc, SMB_ADDR, slave);
 	NFSMB_SMBOUTB(sc, SMB_PRTCL, SMB_PRTCL_READ | SMB_PRTCL_BLOCK_DATA);
 
 	if ((error = nfsmb_wait(sc)) == SMB_ENOERR) {
 		len = NFSMB_SMBINB(sc, SMB_BCNT);
-		len = min(len, 32);
-		for (i = 0; i < len; i++)
-			buf[i] = NFSMB_SMBINB(sc, SMB_DATA + i);
+		for (i = 0; i < len; i++) {
+			data = NFSMB_SMBINB(sc, SMB_DATA + i);
+			if (i < *count)
+				buf[i] = data;
+		}
+		*count = len;
 	}
 
-	NFSMB_DEBUG(printf("nfsmb: READBLK to 0x%x, count=0x%x, cmd=0x%x, error=0x%x", slave, count, cmd, error));
+	NFSMB_DEBUG(printf("nfsmb: READBLK to 0x%x, count=0x%x, cmd=0x%x, error=0x%x", slave, *count, cmd, error));
 
 	return (error);
 }
@@ -555,6 +561,7 @@ static driver_t nfsmbsub_driver = {
 
 DRIVER_MODULE(nfsmb, pci, nfsmb_driver, nfsmb_devclass, 0, 0);
 DRIVER_MODULE(nfsmb, nfsmb, nfsmbsub_driver, nfsmb_devclass, 0, 0);
+DRIVER_MODULE(smbus, nfsmb, smbus_driver, smbus_devclass, 0, 0);
 
 MODULE_DEPEND(nfsmb, pci, 1, 1, 1);
 MODULE_DEPEND(nfsmb, smbus, SMBUS_MINVER, SMBUS_PREFVER, SMBUS_MAXVER);