From a12f5777dfaa5be4dbd91cecea090c1456717ef5 Mon Sep 17 00:00:00 2001
From: Steven Hartland <smh@FreeBSD.org>
Date: Sun, 21 Dec 2014 16:15:29 +0000
Subject: [PATCH] Clamp ahci max irq's to AHCI_MAX_IRQS

This prevents the possiblity of any overruns on the statically allocated
struct irqs field.

Differential Revision:	D838
MFC after:	2 weeks
X-MFC-With:	r276012
Sponsored by:	Multiplay
---
 sys/dev/ahci/ahci.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/sys/dev/ahci/ahci.c b/sys/dev/ahci/ahci.c
index 583983bff7e..8b4066f5820 100644
--- a/sys/dev/ahci/ahci.c
+++ b/sys/dev/ahci/ahci.c
@@ -356,6 +356,14 @@ ahci_setup_interrupt(device_t dev)
 		device_printf(dev, "Falling back to one MSI\n");
 		ctlr->numirqs = 1;
 	}
+
+	/* Ensure we don't overrun irqs. */
+	if (ctlr->numirqs > AHCI_MAX_IRQS) {
+		device_printf(dev, "Too many irqs %d > %d (clamping)\n",
+		    ctlr->numirqs, AHCI_MAX_IRQS);
+		ctlr->numirqs = AHCI_MAX_IRQS;
+	}
+
 	/* Allocate all IRQs. */
 	for (i = 0; i < ctlr->numirqs; i++) {
 		ctlr->irqs[i].ctlr = ctlr;