From owner-svn-src-all@FreeBSD.ORG  Thu Jan  5 21:17:06 2012
Return-Path: <owner-svn-src-all@FreeBSD.ORG>
Delivered-To: svn-src-all@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id C47D3106567A;
	Thu,  5 Jan 2012 21:17:06 +0000 (UTC)
	(envelope-from yongari@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c])
	by mx1.freebsd.org (Postfix) with ESMTP id B218A8FC17;
	Thu,  5 Jan 2012 21:17:06 +0000 (UTC)
Received: from svn.freebsd.org (localhost [127.0.0.1])
	by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id q05LH6Bk055929;
	Thu, 5 Jan 2012 21:17:06 GMT (envelope-from yongari@svn.freebsd.org)
Received: (from yongari@localhost)
	by svn.freebsd.org (8.14.4/8.14.4/Submit) id q05LH6jX055927;
	Thu, 5 Jan 2012 21:17:06 GMT (envelope-from yongari@svn.freebsd.org)
Message-Id: <201201052117.q05LH6jX055927@svn.freebsd.org>
From: Pyun YongHyeon <yongari@FreeBSD.org>
Date: Thu, 5 Jan 2012 21:17:06 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
	svn-src-stable@freebsd.org, svn-src-stable-8@freebsd.org
X-SVN-Group: stable-8
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Cc: 
Subject: svn commit: r229649 - stable/8/sys/dev/ed
X-BeenThere: svn-src-all@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "SVN commit messages for the entire src tree \(except for &quot;
	user&quot; and &quot; projects&quot; \)" <svn-src-all.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-all>,
	<mailto:svn-src-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-all>
List-Post: <mailto:svn-src-all@freebsd.org>
List-Help: <mailto:svn-src-all-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-all>,
	<mailto:svn-src-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 05 Jan 2012 21:17:06 -0000

Author: yongari
Date: Thu Jan  5 21:17:06 2012
New Revision: 229649
URL: http://svn.freebsd.org/changeset/base/229649

Log:
  MFC r228286:
    Fix off by one error in mbuf access.  Previously it caused panic.
    While I'm here use NULL to compare mbuf pointer and add additional
    check for zero length mbuf before accessing the mbuf.
  
    PR:	kern/162932

Modified:
  stable/8/sys/dev/ed/if_ed.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/amd64/include/xen/   (props changed)
  stable/8/sys/cddl/contrib/opensolaris/   (props changed)
  stable/8/sys/contrib/dev/acpica/   (props changed)
  stable/8/sys/contrib/pf/   (props changed)

Modified: stable/8/sys/dev/ed/if_ed.c
==============================================================================
--- stable/8/sys/dev/ed/if_ed.c	Thu Jan  5 20:49:48 2012	(r229648)
+++ stable/8/sys/dev/ed/if_ed.c	Thu Jan  5 21:17:06 2012	(r229649)
@@ -1695,12 +1695,19 @@ ed_shmem_write_mbufs(struct ed_softc *sc
 			break;
 		}
 	}
-	for (len = 0; m != 0; m = m->m_next) {
-		if (sc->isa16bit)
-			bus_space_write_region_2(sc->mem_bst,
-			    sc->mem_bsh, dst,
-			    mtod(m, uint16_t *), (m->m_len + 1)/ 2);
-		else
+	for (len = 0; m != NULL; m = m->m_next) {
+		if (m->m_len == 0)
+			continue;
+		if (sc->isa16bit) {
+			if (m->m_len > 1)
+				bus_space_write_region_2(sc->mem_bst,
+				    sc->mem_bsh, dst,
+				    mtod(m, uint16_t *), m->m_len / 2);
+			if ((m->m_len & 1) != 0)
+				bus_space_write_1(sc->mem_bst, sc->mem_bsh,
+				    dst + m->m_len - 1,
+				    *(mtod(m, uint8_t *) + m->m_len - 1));
+		} else
 			bus_space_write_region_1(sc->mem_bst,
 			    sc->mem_bsh, dst,
 			    mtod(m, uint8_t *), m->m_len);