[Bug 193367] [panic] sleeping thread

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=193367

Konstantin Belousov <kib at FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |kib at FreeBSD.org

--- Comment #10 from Konstantin Belousov <kib at FreeBSD.org> ---
(In reply to Eygene Ryabinkin from comment #8)
> Looks like there is at least off-by-one access to the driver-specific ioctl
> array, http://codelabs.ru/fbsd/patches/drm2/fix-drm_drv-off-by-one.diff,
> since max_ioctl is not a number of a highest supported ioctl number, but
> rather a size of driver's ioctl array.

I think that the patch is wrong, and there is no off-by-one bug.  At least in
i915 case, max_ioctl is initialized as nitems(i915_ioctls), which is the number
of array elements.  Applying your patch, the last ioctl in the driver-specific
array becomes inaccessible.  As an easier test, consider what would happen
after your change if array consists of single element.

-- 
You are receiving this mail because:
You are the assignee for the bug.