From nobody@FreeBSD.org  Fri Mar 28 14:59:45 2008
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 50F86106566C
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 28 Mar 2008 14:59:45 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id 39F498FC23
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 28 Mar 2008 14:59:45 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.2/8.14.2) with ESMTP id m2SExQqq018979
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 28 Mar 2008 14:59:26 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.2/8.14.1/Submit) id m2SExQ0k018978;
	Fri, 28 Mar 2008 14:59:26 GMT
	(envelope-from nobody)
Message-Id: <200803281459.m2SExQ0k018978@www.freebsd.org>
Date: Fri, 28 Mar 2008 14:59:26 GMT
From: Christian Kandeler <christian.kandeler@hob.de>
To: freebsd-gnats-submit@FreeBSD.org
Subject: Alignment problems in if_ed
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         122195
>Category:       kern
>Synopsis:       [ed] Alignment problems in if_ed
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    yongari
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Mar 28 15:00:00 UTC 2008
>Closed-Date:    Mon Aug 23 22:48:38 UTC 2010
>Last-Modified:  Fri Sep 24 19:20:06 UTC 2010
>Originator:     Christian Kandeler
>Release:        7.0
>Organization:
HOB
>Environment:
>Description:
Function ed_pio_write_mbufs() in sys/dev/ed/if_ed.c has at least two
alignment problems:
    1) The savebyte array is cast to an unsigned short pointer and then
dereferenced, but since it is a character array, it may not be suitably aligned.
    2) The call to ed_asic_outsw() assumes that the data pointer can be
dereferenced as an unsigned short, but I don't think there is any
guarantee that it fulfills the alignment requirements.
>How-To-Repeat:

>Fix:


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-net 
Responsible-Changed-By: vwe 
Responsible-Changed-When: Tue Apr 15 19:52:28 UTC 2008 
Responsible-Changed-Why:  

Over to maintainer(s). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=122195 
Responsible-Changed-From-To: freebsd-net->yongari 
Responsible-Changed-By: andre 
Responsible-Changed-When: Mon Aug 23 18:08:39 UTC 2010 
Responsible-Changed-Why:  
Over to expert. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=122195 
State-Changed-From-To: open->feedback 
State-Changed-By: yongari 
State-Changed-When: Mon Aug 23 21:24:49 UTC 2010 
State-Changed-Why:  
Ok, would you try patch at the following URL? 
http://people.freebsd.org/~yongari/ed.align.patch 
I don't have ed(4) a controller that has this limitation so I can't 
verify this. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=122195 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/122195: commit references a PR
Date: Mon, 23 Aug 2010 21:40:13 +0000 (UTC)

 Author: yongari
 Date: Mon Aug 23 21:40:03 2010
 New Revision: 211721
 URL: http://svn.freebsd.org/changeset/base/211721
 
 Log:
   Fix a possible unaligned access to savebyte array.
   
   PR:	kern/122195
 
 Modified:
   head/sys/dev/ed/if_ed.c
 
 Modified: head/sys/dev/ed/if_ed.c
 ==============================================================================
 --- head/sys/dev/ed/if_ed.c	Mon Aug 23 20:53:24 2010	(r211720)
 +++ head/sys/dev/ed/if_ed.c	Mon Aug 23 21:40:03 2010	(r211721)
 @@ -1476,9 +1476,12 @@ ed_pio_write_mbufs(struct ed_softc *sc, 
  		}
  	} else {
  		/* NE2000s are a pain */
 -		unsigned char *data;
 +		uint8_t *data;
  		int len, wantbyte;
 -		unsigned char savebyte[2];
 +		union {
 +			uint16_t w;
 +			uint8_t b[2];
 +		} saveword;
  
  		wantbyte = 0;
  
 @@ -1488,9 +1491,9 @@ ed_pio_write_mbufs(struct ed_softc *sc, 
  				data = mtod(m, caddr_t);
  				/* finish the last word */
  				if (wantbyte) {
 -					savebyte[1] = *data;
 +					saveword.b[1] = *data;
  					ed_asic_outw(sc, ED_NOVELL_DATA,
 -						     *(u_short *)savebyte);
 +					    saveword.w);
  					data++;
  					len--;
  					wantbyte = 0;
 @@ -1504,7 +1507,7 @@ ed_pio_write_mbufs(struct ed_softc *sc, 
  				}
  				/* save last byte, if necessary */
  				if (len == 1) {
 -					savebyte[0] = *data;
 +					saveword.b[0] = *data;
  					wantbyte = 1;
  				}
  			}
 @@ -1512,7 +1515,7 @@ ed_pio_write_mbufs(struct ed_softc *sc, 
  		}
  		/* spit last byte */
  		if (wantbyte)
 -			ed_asic_outw(sc, ED_NOVELL_DATA, *(u_short *)savebyte);
 +			ed_asic_outw(sc, ED_NOVELL_DATA, saveword.w);
  	}
  
  	/*
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: feedback->closed 
State-Changed-By: yongari 
State-Changed-When: Mon Aug 23 22:47:48 UTC 2010 
State-Changed-Why:  
Close, mail bounced. 
Fix committed to HEAD(r211721). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=122195 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/122195: commit references a PR
Date: Fri, 24 Sep 2010 19:13:47 +0000 (UTC)

 Author: yongari
 Date: Fri Sep 24 19:13:43 2010
 New Revision: 213122
 URL: http://svn.freebsd.org/changeset/base/213122
 
 Log:
   MFC r211721:
     Fix a possible unaligned access to savebyte array.
   
     PR:	kern/122195
 
 Modified:
   stable/8/sys/dev/ed/if_ed.c
 Directory Properties:
   stable/8/sys/   (props changed)
   stable/8/sys/amd64/include/xen/   (props changed)
   stable/8/sys/cddl/contrib/opensolaris/   (props changed)
   stable/8/sys/contrib/dev/acpica/   (props changed)
   stable/8/sys/contrib/pf/   (props changed)
   stable/8/sys/dev/xen/xenpci/   (props changed)
 
 Modified: stable/8/sys/dev/ed/if_ed.c
 ==============================================================================
 --- stable/8/sys/dev/ed/if_ed.c	Fri Sep 24 19:11:22 2010	(r213121)
 +++ stable/8/sys/dev/ed/if_ed.c	Fri Sep 24 19:13:43 2010	(r213122)
 @@ -1462,9 +1462,12 @@ ed_pio_write_mbufs(struct ed_softc *sc, 
  		}
  	} else {
  		/* NE2000s are a pain */
 -		unsigned char *data;
 +		uint8_t *data;
  		int len, wantbyte;
 -		unsigned char savebyte[2];
 +		union {
 +			uint16_t w;
 +			uint8_t b[2];
 +		} saveword;
  
  		wantbyte = 0;
  
 @@ -1474,9 +1477,9 @@ ed_pio_write_mbufs(struct ed_softc *sc, 
  				data = mtod(m, caddr_t);
  				/* finish the last word */
  				if (wantbyte) {
 -					savebyte[1] = *data;
 +					saveword.b[1] = *data;
  					ed_asic_outw(sc, ED_NOVELL_DATA,
 -						     *(u_short *)savebyte);
 +					    saveword.w);
  					data++;
  					len--;
  					wantbyte = 0;
 @@ -1490,7 +1493,7 @@ ed_pio_write_mbufs(struct ed_softc *sc, 
  				}
  				/* save last byte, if necessary */
  				if (len == 1) {
 -					savebyte[0] = *data;
 +					saveword.b[0] = *data;
  					wantbyte = 1;
  				}
  			}
 @@ -1498,7 +1501,7 @@ ed_pio_write_mbufs(struct ed_softc *sc, 
  		}
  		/* spit last byte */
  		if (wantbyte)
 -			ed_asic_outw(sc, ED_NOVELL_DATA, *(u_short *)savebyte);
 +			ed_asic_outw(sc, ED_NOVELL_DATA, saveword.w);
  	}
  
  	/*
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/122195: commit references a PR
Date: Fri, 24 Sep 2010 19:15:09 +0000 (UTC)

 Author: yongari
 Date: Fri Sep 24 19:14:59 2010
 New Revision: 213123
 URL: http://svn.freebsd.org/changeset/base/213123
 
 Log:
   MFC r211721:
     Fix a possible unaligned access to savebyte array.
   
     PR:	kern/122195
 
 Modified:
   stable/7/sys/dev/ed/if_ed.c
 Directory Properties:
   stable/7/sys/   (props changed)
   stable/7/sys/cddl/contrib/opensolaris/   (props changed)
   stable/7/sys/contrib/dev/acpica/   (props changed)
   stable/7/sys/contrib/pf/   (props changed)
 
 Modified: stable/7/sys/dev/ed/if_ed.c
 ==============================================================================
 --- stable/7/sys/dev/ed/if_ed.c	Fri Sep 24 19:13:43 2010	(r213122)
 +++ stable/7/sys/dev/ed/if_ed.c	Fri Sep 24 19:14:59 2010	(r213123)
 @@ -1457,9 +1457,12 @@ ed_pio_write_mbufs(struct ed_softc *sc, 
  		}
  	} else {
  		/* NE2000s are a pain */
 -		unsigned char *data;
 +		uint8_t *data;
  		int len, wantbyte;
 -		unsigned char savebyte[2];
 +		union {
 +			uint16_t w;
 +			uint8_t b[2];
 +		} saveword;
  
  		wantbyte = 0;
  
 @@ -1469,9 +1472,9 @@ ed_pio_write_mbufs(struct ed_softc *sc, 
  				data = mtod(m, caddr_t);
  				/* finish the last word */
  				if (wantbyte) {
 -					savebyte[1] = *data;
 +					saveword.b[1] = *data;
  					ed_asic_outw(sc, ED_NOVELL_DATA,
 -						     *(u_short *)savebyte);
 +					    saveword.w);
  					data++;
  					len--;
  					wantbyte = 0;
 @@ -1485,7 +1488,7 @@ ed_pio_write_mbufs(struct ed_softc *sc, 
  				}
  				/* save last byte, if necessary */
  				if (len == 1) {
 -					savebyte[0] = *data;
 +					saveword.b[0] = *data;
  					wantbyte = 1;
  				}
  			}
 @@ -1493,7 +1496,7 @@ ed_pio_write_mbufs(struct ed_softc *sc, 
  		}
  		/* spit last byte */
  		if (wantbyte)
 -			ed_asic_outw(sc, ED_NOVELL_DATA, *(u_short *)savebyte);
 +			ed_asic_outw(sc, ED_NOVELL_DATA, saveword.w);
  	}
  
  	/*
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
>Unformatted:
