diff options
| author | Miod Vallat <miod@cvs.openbsd.org> | 2004-03-19 21:04:01 +0000 |
|---|---|---|
| committer | Miod Vallat <miod@cvs.openbsd.org> | 2004-03-19 21:04:01 +0000 |
| commit | cd0a1beb40e7d18a5f1eef323ae43440466210f1 (patch) | |
| tree | f3538206bda0c0eaad0a536c1e9ef2767253823c /sys/arch/sparc64/dev | |
| parent | 425db1b40fd56d5f868ad09e03c14e8d0fa48045 (diff) | |
Off-by-ones, requests for (x * PAGE_SIZE) + 1 bytes would not allocate the
last page. Found the hard way by chris@ and claudio@.
ok jason@ deraadt@
Diffstat (limited to 'sys/arch/sparc64/dev')
| -rw-r--r-- | sys/arch/sparc64/dev/iommu.c | 13 |
1 files changed, 6 insertions, 7 deletions
diff --git a/sys/arch/sparc64/dev/iommu.c b/sys/arch/sparc64/dev/iommu.c index 77a508533eb..bca2e3994f2 100644 --- a/sys/arch/sparc64/dev/iommu.c +++ b/sys/arch/sparc64/dev/iommu.c @@ -1,4 +1,4 @@ -/* $OpenBSD: iommu.c,v 1.34 2003/12/20 20:08:17 miod Exp $ */ +/* $OpenBSD: iommu.c,v 1.35 2004/03/19 21:04:00 miod Exp $ */ /* $NetBSD: iommu.c,v 1.47 2002/02/08 20:03:45 eeh Exp $ */ /* @@ -695,7 +695,7 @@ iommu_dvmamap_load(bus_dma_tag_t t, bus_dma_tag_t t0, bus_dmamap_t map, bus_addr_t addr = (vaddr_t)buf; int seg_len = buflen; - aend = round_page(addr + seg_len - 1); + aend = round_page(addr + seg_len); for (a = trunc_page(addr); a < aend; a += PAGE_SIZE) { paddr_t pa; @@ -771,7 +771,7 @@ iommu_dvmamap_load(bus_dma_tag_t t, bus_dma_tag_t t0, bus_dmamap_t map, bus_addr_t addr = (vaddr_t)buf; int seg_len = buflen; - aend = round_page(addr + seg_len - 1); + aend = round_page(addr + seg_len); for (a = trunc_page(addr); a < aend; a += PAGE_SIZE) { bus_addr_t pgstart; bus_addr_t pgend; @@ -911,7 +911,7 @@ iommu_dvmamap_load_raw(bus_dma_tag_t t, bus_dma_tag_t t0, bus_dmamap_t map, if (len < 1) continue; - aend = round_page(addr + seg_len - 1); + aend = round_page(addr + seg_len); for (a = trunc_page(addr); a < aend; a += PAGE_SIZE) { err = iommu_iomap_insert_page(ims, a); @@ -1194,9 +1194,8 @@ iommu_dvmamap_load_seg(bus_dma_tag_t t, struct iommu_state *is, if (len < 1) continue; - aend = addr + seg_len - 1; - for (a = trunc_page(addr); a < round_page(aend); - a += PAGE_SIZE) { + aend = round_page(addr + seg_len); + for (a = trunc_page(addr); a < aend; a += PAGE_SIZE) { bus_addr_t pgstart; bus_addr_t pgend; int pglen; |