d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix read past end of struct in ncsw glue code.

Browse Source 
The logic in XX_IsPortalIntr() was reading past the end of XX_PInfo.
This was causing it to erroneously return 1 instead of 0 in some
circumstances, causing a panic on the AmigaOne X5000 due to mixing
exclusive and nonexclusive interrupts on the same interrupt line.

Since this code is only called a couple of times during startup, use
a simple double loop instead of the complex read-ahead single loop.

This also fixes a bug where it would never check cpu=0 on type=1.

Approved by: jhibbits (mentor)
Differential Revision: https://reviews.freebsd.org/D21988
This commit is contained in:
Brandon Bergren 2019-10-12 23:16:17 +00:00
parent 6cc9ab8610
commit 9f15304d32
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=353459
1 changed files with 4 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sys/contrib/ncsw/user/env/xx.c vendored
View File

@ -288,16 +288,10 @@ XX_IsPortalIntr(uintptr_t irq)
{
int cpu, type;
/* Check interrupt numbers of all available portals */
for (cpu = 0, type = 0; XX_PInfo.portal_intr[type][cpu] != 0; cpu++) {
if (irq == XX_PInfo.portal_intr[type][cpu]) {
/* Found it! */
return (1);
}
if (XX_PInfo.portal_intr[type][cpu + 1] == 0) {
type++;
cpu = 0;
}
}
for (type = 0; type < 2; type++)
for (cpu = 0; cpu < MAXCPU; cpu++)
if (irq == XX_PInfo.portal_intr[type][cpu])
return (1);
return (0);
}