From: jan <jan@openbsd.org>
Date: Wed, 18 Oct 2023 14:24:29 +0000 (+0000)
Subject: Avoid segments greater than maxsegsz during map merging
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=d987d4292a61ac9fa80adafd18b5044239366906;p=openbsd

Avoid segments greater than maxsegsz during map merging

Found with hints from kettenis@

Tested on Sun-Fire-V215.
Also tested on U2 and UltraBook IIe by miod@

ok miod@
---

diff --git a/sys/arch/sparc64/dev/iommu.c b/sys/arch/sparc64/dev/iommu.c
index 1e2c7c25ca5..7730925b4a4 100644
--- a/sys/arch/sparc64/dev/iommu.c
+++ b/sys/arch/sparc64/dev/iommu.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: iommu.c,v 1.82 2021/05/16 15:10:19 deraadt Exp $	*/
+/*	$OpenBSD: iommu.c,v 1.83 2023/10/18 14:24:29 jan Exp $	*/
 /*	$NetBSD: iommu.c,v 1.47 2002/02/08 20:03:45 eeh Exp $	*/
 
 /*
@@ -1143,7 +1143,8 @@ iommu_dvmamap_insert(bus_dma_tag_t t, bus_dmamap_t map,
 	 */
 	if (i > 0) {
 		seg = &map->dm_segs[i - 1];
-		if (sgstart == seg->ds_addr + seg->ds_len) {
+		if (sgstart == seg->ds_addr + seg->ds_len &&
+		    length + seg->ds_len <= map->_dm_maxsegsz) {
 			length += seg->ds_len;
 			sgstart = seg->ds_addr;
 			sgend = sgstart + length - 1;