mirror of
https://git.FreeBSD.org/src.git
synced 2024-11-25 07:49:18 +00:00
558c1b3733
The loop condition in the dmamap_load_buffer() method is 'buflen > 0',
and buflen is an unsigned type (bus_size_t).
A recent change made it possible for sgsize to exceed the remaining
buflen, when the tag has a large alignment requirement. The result is
that we would not break out of the loop at the correct time. Fix this by
avoiding underflow in the subtraction at the end of the loop.
PR: 279383
Reported by: Robert Morris <rtm@lcs.mit.edu>
Reviewed by: jhibbits
Fixes:
|
||
---|---|---|
.. | ||
acpica | ||
bios | ||
conf | ||
cpufreq | ||
include | ||
iommu | ||
isa | ||
linux | ||
pci | ||
x86 | ||
xen |