From 893edbea10a8e2a2c8c9f020f0b70e8fb6435de5 Mon Sep 17 00:00:00 2001 From: Adrian Chadd Date: Sun, 15 Mar 2015 20:09:47 +0000 Subject: [PATCH] Fix mbuf mapping errors in wpi_cmd2() + add check for nsegs PR: kern/197143 Submitted by: Andriy Voskoboinyk --- sys/dev/wpi/if_wpi.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sys/dev/wpi/if_wpi.c b/sys/dev/wpi/if_wpi.c index fa1948c09b7..7518b799f71 100644 --- a/sys/dev/wpi/if_wpi.c +++ b/sys/dev/wpi/if_wpi.c @@ -2272,7 +2272,7 @@ wpi_cmd2(struct wpi_softc *sc, struct wpi_buf *buf) } if (error != 0) { /* Too many DMA segments, linearize mbuf. */ - m1 = m_collapse(buf->m, M_NOWAIT, WPI_MAX_SCATTER); + m1 = m_collapse(buf->m, M_NOWAIT, WPI_MAX_SCATTER - 1); if (m1 == NULL) { device_printf(sc->sc_dev, "%s: could not defrag mbuf\n", __func__); @@ -2291,6 +2291,10 @@ wpi_cmd2(struct wpi_softc *sc, struct wpi_buf *buf) } } + KASSERT(nsegs < WPI_MAX_SCATTER, + ("too many DMA segments, nsegs (%d) should be less than %d", + nsegs, WPI_MAX_SCATTER)); + data->m = buf->m; data->ni = buf->ni;