Author: bde Date: Thu Aug 25 12:04:57 2016 New Revision: 304800 URL: https://svnweb.freebsd.org/changeset/base/304800
Log: Fix logic errors in bounds checks in previous commit. The 2-entry stack was overrun for grab levels larger than 2. Reported by: pluknet Modified: head/sys/dev/syscons/syscons.c Modified: head/sys/dev/syscons/syscons.c ============================================================================== --- head/sys/dev/syscons/syscons.c Thu Aug 25 10:53:03 2016 (r304799) +++ head/sys/dev/syscons/syscons.c Thu Aug 25 12:04:57 2016 (r304800) @@ -1729,7 +1729,7 @@ sc_cngrab(struct consdev *cp) sc = sc_console->sc; lev = atomic_fetchadd_int(&sc->grab_level, 1); - if (lev >= 0 || lev < 2) + if (lev >= 0 && lev < 2) sccnopen(sc, &sc->grab_state[lev], 1 | 2); } @@ -1741,7 +1741,7 @@ sc_cnungrab(struct consdev *cp) sc = sc_console->sc; lev = atomic_load_acq_int(&sc->grab_level) - 1; - if (lev >= 0 || lev < 2) + if (lev >= 0 && lev < 2) sccnclose(sc, &sc->grab_state[lev]); atomic_add_int(&sc->grab_level, -1); } _______________________________________________ svn-src-all@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-all To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"