From 98ebfa3812310a322be1fc6fe236cfe64bb891e4 Mon Sep 17 00:00:00 2001
From: hadaq <hadaq>
Date: Fri, 9 Mar 2012 00:52:30 +0000
Subject: [PATCH] update

---
 pexor/kernel-module/pexor_trb.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/pexor/kernel-module/pexor_trb.c b/pexor/kernel-module/pexor_trb.c
index 27b03e0..e80e19f 100644
--- a/pexor/kernel-module/pexor_trb.c
+++ b/pexor/kernel-module/pexor_trb.c
@@ -1450,6 +1450,14 @@ int pexor_ioctl_trbnet_request(struct pexor_privdata *priv, unsigned long arg)
     status = dmaSize;
     pexor_read_buffer_ctr = dmaSize * 4;
     
+    /* Check dmaSize */
+    if ((dmaSize * 4) >= (priv->dma.size * PAGE_SIZE)) {
+      pexor_msg(KERN_ERR
+                "ERROR> Invalid DMA Size %d, larger than dmaSize\n", dmaSize);
+      status = -204;
+      goto OUT_IOCTL;
+    }
+
     /* Check Credentials */
     cred2 = ioread32(priv->pexor.dma_debug2);
     if (cred2 != cred1) {
@@ -1463,8 +1471,9 @@ int pexor_ioctl_trbnet_request(struct pexor_privdata *priv, unsigned long arg)
 #ifdef PEXOR_TRB_DEBUG
     {
       int i;
-      pexor_msg(KERN_ERR "DMA: dmaSize: %d\n", dmaSize);
-      for (i = 0; i < dmaSize + 20; i++) {
+      pexor_msg(KERN_ERR "DMA: dmaSize: %d   pexor_read_buffer_ctr: %d\n",
+                dmaSize, (int)pexor_read_buffer_ctr);
+      for (i = 0; i < dmaSize; i++) {
         u32 val = 0;
         val = ioread32((i % 2 == 0)
                        ? priv->pexor.dma_debug0 : priv->pexor.dma_debug1);
-- 
2.43.0