Attachment 210009 Details for Bug 242654 – proposed patch

[patch] proposed patch

diff (text/plain), 2.71 KB, created by Mark Johnston on 2019-12-17 16:14:24 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Mark Johnston

Created: 2019-12-17 16:14:24 UTC

Size: 2.71 KB

patch

obsolete

>diff --git a/sys/dev/an/if_an.c b/sys/dev/an/if_an.c
>index a2418e4119cd..70866f1d002b 100644
>--- a/sys/dev/an/if_an.c
>+++ b/sys/dev/an/if_an.c
>@@ -1875,6 +1875,7 @@ an_ioctl(struct ifnet *ifp, u_long command, caddr_t data)
> 	int			len;
> 	int			i, max;
> 	struct an_softc		*sc;
>+	struct an_req		*areq;
> 	struct ifreq		*ifr;
> 	struct thread		*td = curthread;
> 	struct ieee80211req	*ireq;
>@@ -1934,17 +1935,21 @@ an_ioctl(struct ifnet *ifp, u_long command, caddr_t data)
> 		error = 0;
> 		break;
> 	case SIOCGAIRONET:
>-		error = copyin(ifr_data_get_ptr(ifr), &sc->areq,
>-		    sizeof(sc->areq));
>-		if (error != 0)
>+		error = priv_check(td, PRIV_DRIVER);
>+		if (error)
> 			break;
>+		areq = malloc(sizeof(*areq), M_TEMP, M_WAITOK);
>+		error = copyin(ifr_data_get_ptr(ifr), areq, sizeof(*areq));
>+		if (error != 0) {
>+			free(areq, M_TEMP);
>+			break;
>+		}
> 		AN_LOCK(sc);
>+		memcpy(&sc->areq, areq, sizeof(sc->areq));
> #ifdef ANCACHE
> 		if (sc->areq.an_type == AN_RID_ZERO_CACHE) {
>-			error = priv_check(td, PRIV_DRIVER);
>-			if (error)
>-				break;
> 			sc->an_sigitems = sc->an_nextitem = 0;
>+			free(areq, M_TEMP);
> 			break;
> 		} else if (sc->areq.an_type == AN_RID_READ_CACHE) {
> 			char *pt = (char *)&sc->areq.an_val;
>@@ -1960,12 +1965,14 @@ an_ioctl(struct ifnet *ifp, u_long command, caddr_t data)
> #endif
> 		if (an_read_record(sc, (struct an_ltv_gen *)&sc->areq)) {
> 			AN_UNLOCK(sc);
>+			free(areq, M_TEMP);
> 			error = EINVAL;
> 			break;
> 		}
>+		memcpy(areq, &sc->areq, sizeof(*areq));
> 		AN_UNLOCK(sc);
>-		error = copyout(&sc->areq, ifr_data_get_ptr(ifr),
>-		    sizeof(sc->areq));
>+		error = copyout(areq, ifr_data_get_ptr(ifr), sizeof(*areq));
>+		free(areq, M_TEMP);
> 		break;
> 	case SIOCSAIRONET:
> 		if ((error = priv_check(td, PRIV_DRIVER)))
>diff --git a/sys/dev/vnic/thunder_bgx_fdt.c b/sys/dev/vnic/thunder_bgx_fdt.c
>index a295c18d73bd..37ebcad37b4d 100644
>--- a/sys/dev/vnic/thunder_bgx_fdt.c
>+++ b/sys/dev/vnic/thunder_bgx_fdt.c
>@@ -35,6 +35,7 @@ __FBSDID("$FreeBSD$");
> #include <sys/bitset.h>
> #include <sys/bitstring.h>
> #include <sys/bus.h>
>+#include <sys/ctype.h>
> #include <sys/endian.h>
> #include <sys/kernel.h>
> #include <sys/malloc.h>
>@@ -151,6 +152,7 @@ bgx_fdt_phy_name_match(struct bgx *bgx, char *phy_name, ssize_t size)
> {
> 	const char *type;
> 	ssize_t sz;
>+	char last;
> 
> 	switch (bgx->qlm_mode) {
> 	case QLM_MODE_SGMII:
>@@ -193,10 +195,11 @@ bgx_fdt_phy_name_match(struct bgx *bgx, char *phy_name, ssize_t size)
> 
> 	if (sz > size)
> 		return (FALSE);
>-	if (strncmp(phy_name, type, sz - 1) == 0 &&
>-	    (phy_name[sz - 1] == '\0' || phy_name[sz - 1] == '@'))
>-		return (TRUE);
>-
>+	if (strncmp(phy_name, type, sz - 1) == 0) {
>+		last = phy_name[sz - 1];
>+		if (last == '\0' || last == '@' || isdigit(last))
>+			return (TRUE);
>+	}
> 	return (FALSE);
> }
>

Actions: View | Diff

Attachments on bug 242654: 210001 | 210009