Re: [PATCH] libata: fix out-of-bounds access in pata_oldpiix.c

[Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>]

On Friday 18 July 2008, Alan Cox wrote:
> On Fri, 18 Jul 2008 09:06:12 +0200
> David Müller <dave.mueller@gmx.ch> wrote:
> 
> > The "pata_oldpiix" driver in linux-2.6.26 is calling its "set_dmamode" 
> > routine also locally, but under different preconditions as the 
> > corresponding call in libata-core.c. This may cause an "out-of-array 
> > bounds" access in "oldpiix_set_dmamode".
> 
> This looks wrong adev->dma_mode should never be invalid at this point.
> Are you not confusing dma_mask and dma_mode. Can you provide the
> backtraces of the failing case and the actual chip variant you are using ?
> 
> Either way the fix is not in oldpiix if this is appearing as 0xFF but in
> the core code so NAK

->dma_mode == 0xff means that DMA is unsupported by a given device
and according to the core code it is a valid ->dma_mode setting.

This may want to be changed in the future but as the things are right
now David's patch is correct and fixes a real bug.  Please UNNAK.

Thanks,
Bart