Below a diff to convert i386/nvram.c to use uiomove(). A similar diff
for amd64 has already been committed. (See
https://marc.info/?l=openbsd-tech&m=142860367111291) Also, pos is
converted to off_t for both amd64 and i386 to prevent truncation and
signedness mismatch. Calling nvramread() with a uio_offset < 0 produced
unexpected results before. The patch adds a check to disallow such a
call.
cheers,
natano
Index: arch//amd64/amd64/nvram.c
===================================================================
RCS file: /cvs/src/sys/arch/amd64/amd64/nvram.c,v
retrieving revision 1.4
diff -u -p -u -r1.4 nvram.c
--- arch//amd64/amd64/nvram.c 11 May 2015 01:56:26 -0000 1.4
+++ arch//amd64/amd64/nvram.c 1 Jan 2016 12:29:43 -0000
@@ -92,7 +92,7 @@ int
nvramread(dev_t dev, struct uio *uio, int flags)
{
u_char buf[NVRAM_SIZE];
- u_int pos = uio->uio_offset;
+ off_t pos = uio->uio_offset;
u_char *tmp;
size_t count = ulmin(sizeof(buf), uio->uio_resid);
int ret;
@@ -100,11 +100,14 @@ nvramread(dev_t dev, struct uio *uio, in
if (!nvram_initialized)
return (ENXIO);
+ if (uio->uio_offset < 0)
+ return (EINVAL);
+
if (uio->uio_resid == 0)
return (0);
#ifdef NVRAM_DEBUG
- printf("attempting to read %zu bytes at offset %d\n", count, pos);
+ printf("attempting to read %zu bytes at offset %lld\n", count, pos);
#endif
for (tmp = buf; count-- > 0 && pos < NVRAM_SIZE; ++pos, ++tmp)
Index: arch//i386/i386/nvram.c
===================================================================
RCS file: /cvs/src/sys/arch/i386/i386/nvram.c,v
retrieving revision 1.4
diff -u -p -u -r1.4 nvram.c
--- arch//i386/i386/nvram.c 10 Feb 2015 21:56:09 -0000 1.4
+++ arch//i386/i386/nvram.c 1 Jan 2016 12:29:49 -0000
@@ -93,29 +93,32 @@ int
nvramread(dev_t dev, struct uio *uio, int flags)
{
u_char buf[NVRAM_SIZE];
- u_int pos = uio->uio_offset;
+ off_t pos = uio->uio_offset;
u_char *tmp;
- int count = min(sizeof(buf), uio->uio_resid);
+ size_t count = ulmin(sizeof(buf), uio->uio_resid);
int ret;
if (!nvram_initialized)
return (ENXIO);
+ if (uio->uio_offset < 0)
+ return (EINVAL);
+
if (uio->uio_resid == 0)
return (0);
#ifdef NVRAM_DEBUG
- printf("attempting to read %d bytes at offset %d\n", count, pos);
+ printf("attempting to read %zu bytes at offset %lld\n", count, pos);
#endif
for (tmp = buf; count-- > 0 && pos < NVRAM_SIZE; ++pos, ++tmp)
*tmp = nvram_get_byte(pos);
#ifdef NVRAM_DEBUG
- printf("nvramread read %d bytes (%s)\n", (tmp - buf), tmp);
+ printf("nvramread read %td bytes (%s)\n", (tmp - buf), tmp);
#endif
- ret = uiomovei((caddr_t)buf, (tmp - buf), uio);
+ ret = uiomove(buf, (tmp - buf), uio);
uio->uio_offset += uio->uio_resid;