Add bounds checks for access to mp_busses.

4 files changed, 12 insertions, 12 deletions

diff --git a/sys/arch/amd64/amd64/intr.c b/sys/arch/amd64/amd64/intr.c
index cb9a761cecc..4b3bcc200c5 100644
--- a/sys/arch/amd64/amd64/intr.c
+++ b/sys/arch/amd64/amd64/intr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: intr.c,v 1.29 2011/06/16 19:46:39 kettenis Exp $	*/
+/*	$OpenBSD: intr.c,v 1.30 2011/10/21 20:48:11 kettenis Exp $	*/
 /*	$NetBSD: intr.c,v 1.3 2003/03/03 22:16:20 fvdl Exp $	*/
 
 /*
@@ -178,10 +178,10 @@ intr_find_mpmapping(int bus, int pin, int *handle)
 {
 	struct mp_intr_map *mip;
 
-	if (bus == -1 || mp_busses[bus].mb_intrs == NULL)
+	if (bus == -1 || bus >= mp_nbusses)
 		return ENOENT;
 
-	for (mip = mp_busses[bus].mb_intrs; mip != NULL; mip=mip->next) {
+	for (mip = mp_busses[bus].mb_intrs; mip != NULL; mip = mip->next) {
 		if (mip->bus_pin == pin) {
 			*handle = mip->ioapic_ih;
 			return 0;
diff --git a/sys/arch/amd64/amd64/mainbus.c b/sys/arch/amd64/amd64/mainbus.c
index a5b1b1c5cdd..161034edf0b 100644
--- a/sys/arch/amd64/amd64/mainbus.c
+++ b/sys/arch/amd64/amd64/mainbus.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mainbus.c,v 1.23 2010/11/03 10:15:22 dlg Exp $	*/
+/*	$OpenBSD: mainbus.c,v 1.24 2011/10/21 20:48:11 kettenis Exp $	*/
 /*	$NetBSD: mainbus.c,v 1.1 2003/04/26 18:39:29 fvdl Exp $	*/
 
 /*
@@ -115,7 +115,7 @@ struct isabus_attach_args mba_iba = {
 
 #if NMPBIOS > 0 || NACPI > 0
 struct mp_bus *mp_busses;
-int mp_nbus;
+int mp_nbusses;
 struct mp_intr_map *mp_intrs;
 int mp_nintrs;
 
diff --git a/sys/arch/amd64/amd64/mpbios.c b/sys/arch/amd64/amd64/mpbios.c
index 89b39ad7a60..f7aed069e90 100644
--- a/sys/arch/amd64/amd64/mpbios.c
+++ b/sys/arch/amd64/amd64/mpbios.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mpbios.c,v 1.20 2011/04/02 22:51:53 marco Exp $	*/
+/*	$OpenBSD: mpbios.c,v 1.21 2011/10/21 20:48:11 kettenis Exp $	*/
 /*	$NetBSD: mpbios.c,v 1.7 2003/05/15 16:32:50 fvdl Exp $	*/
 
 /*-
@@ -581,8 +581,8 @@ mpbios_scan(struct device *self)
 			if (type == MPS_MCT_BUS) {
 				const struct mpbios_bus *bp =
 				    (const struct mpbios_bus *)position;
-				if (bp->bus_id >= mp_nbus)
-					mp_nbus = bp->bus_id + 1;
+				if (bp->bus_id >= mp_nbusses)
+					mp_nbusses = bp->bus_id + 1;
 			}
 			/*
 			 * Count actual interrupt instances.
@@ -601,7 +601,7 @@ mpbios_scan(struct device *self)
 			position += mp_conf[type].length;
 		}
 
-		mp_busses = malloc(sizeof(struct mp_bus) * mp_nbus,
+		mp_busses = malloc(sizeof(struct mp_bus) * mp_nbusses,
 		    M_DEVBUF, M_NOWAIT|M_ZERO);
 		mp_intrs = malloc(sizeof(struct mp_intr_map) * intr_cnt,
 		    M_DEVBUF, M_NOWAIT);
@@ -924,7 +924,7 @@ mpbios_bus(const u_int8_t *ent, struct device *self)
 	 * This "should not happen" unless the table changes out
 	 * from underneath us
 	 */
-	if (bus_id >= mp_nbus) {
+	if (bus_id >= mp_nbusses) {
 		panic("%s: bus number %d out of range?? (type %6.6s)",
 		    self->dv_xname, bus_id, entry->bus_type);
 	}
diff --git a/sys/arch/amd64/include/mpconfig.h b/sys/arch/amd64/include/mpconfig.h
index 7b78dfcfdc5..8a154db560e 100644
--- a/sys/arch/amd64/include/mpconfig.h
+++ b/sys/arch/amd64/include/mpconfig.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mpconfig.h,v 1.7 2011/03/06 22:40:05 deraadt Exp $	*/
+/*	$OpenBSD: mpconfig.h,v 1.8 2011/10/21 20:48:11 kettenis Exp $	*/
 /*	$NetBSD: mpconfig.h,v 1.2 2003/05/11 00:05:52 fvdl Exp $	*/
 
 /*
@@ -38,11 +38,11 @@ struct mp_intr_map {
 #if defined(_KERNEL)
 extern int mp_verbose;
 extern struct mp_bus *mp_busses;
+extern int mp_nbusses;
 extern struct mp_intr_map *mp_intrs;
 extern int mp_nintrs;
 extern struct mp_bus *mp_isa_bus;
 extern struct mp_bus *mp_eisa_bus;
-extern int mp_nbus;
 #endif
 #endif