6929493 fix for 6920774 is incomplete

2 files changed, 25 insertions, 21 deletions

diff --git a/usr/src/uts/common/io/cmlb.c b/usr/src/uts/common/io/cmlb.c
index 54ac010bce..0d174501f5 100644
--- a/usr/src/uts/common/io/cmlb.c
+++ b/usr/src/uts/common/io/cmlb.c
@@ -4117,14 +4117,16 @@ cmlb_dkio_get_efi(struct cmlb_lun *cl, caddr_t arg, int flag, void *tg_cookie)
 
 	user_efi.dki_data = (void *)(uintptr_t)user_efi.dki_data_64;
 
-	if (user_efi.dki_length > cmlb_tg_max_efi_xfer)
+	if (user_efi.dki_length == 0 ||
+	    user_efi.dki_length > cmlb_tg_max_efi_xfer)
 		return (EINVAL);
 
 	tgt_lba = user_efi.dki_lba;
 
 	mutex_enter(CMLB_MUTEX(cl));
 	if ((cmlb_check_update_blockcount(cl, tg_cookie) != 0) ||
-	    (cl->cl_tgt_blocksize == 0)) {
+	    (cl->cl_tgt_blocksize == 0) ||
+	    (user_efi.dki_length % cl->cl_sys_blocksize)) {
 		mutex_exit(CMLB_MUTEX(cl));
 		return (EINVAL);
 	}
@@ -4934,9 +4936,24 @@ cmlb_dkio_set_efi(struct cmlb_lun *cl, dev_t dev, caddr_t arg, int flag,
 
 	user_efi.dki_data = (void *)(uintptr_t)user_efi.dki_data_64;
 
-	if (user_efi.dki_length > cmlb_tg_max_efi_xfer)
+	if (user_efi.dki_length == 0 ||
+	    user_efi.dki_length > cmlb_tg_max_efi_xfer)
 		return (EINVAL);
 
+	tgt_lba = user_efi.dki_lba;
+
+	mutex_enter(CMLB_MUTEX(cl));
+	if ((cmlb_check_update_blockcount(cl, tg_cookie) != 0) ||
+	    (cl->cl_tgt_blocksize == 0) ||
+	    (user_efi.dki_length % cl->cl_sys_blocksize)) {
+		mutex_exit(CMLB_MUTEX(cl));
+		return (EINVAL);
+	}
+	if (cl->cl_tgt_blocksize != cl->cl_sys_blocksize)
+		tgt_lba = tgt_lba *
+		    cl->cl_tgt_blocksize / cl->cl_sys_blocksize;
+	mutex_exit(CMLB_MUTEX(cl));
+
 	buffer = kmem_alloc(user_efi.dki_length, KM_SLEEP);
 	if (ddi_copyin(user_efi.dki_data, buffer, user_efi.dki_length, flag)) {
 		rval = EFAULT;
@@ -4966,20 +4983,6 @@ cmlb_dkio_set_efi(struct cmlb_lun *cl, dev_t dev, caddr_t arg, int flag,
 		} else
 			mutex_exit(CMLB_MUTEX(cl));
 
-		tgt_lba = user_efi.dki_lba;
-
-		mutex_enter(CMLB_MUTEX(cl));
-		if ((cmlb_check_update_blockcount(cl, tg_cookie) != 0) ||
-		    (cl->cl_tgt_blocksize == 0)) {
-			kmem_free(buffer, user_efi.dki_length);
-			mutex_exit(CMLB_MUTEX(cl));
-			return (EINVAL);
-		}
-		if (cl->cl_tgt_blocksize != cl->cl_sys_blocksize)
-			tgt_lba = tgt_lba *
-			    cl->cl_tgt_blocksize / cl->cl_sys_blocksize;
-
-		mutex_exit(CMLB_MUTEX(cl));
 		rval = DK_TG_WRITE(cl, buffer, tgt_lba, user_efi.dki_length,
 		    tg_cookie);
 
diff --git a/usr/src/uts/intel/io/dktp/disk/cmdk.c b/usr/src/uts/intel/io/dktp/disk/cmdk.c
index 8e144b05a9..2acc3446b6 100644
--- a/usr/src/uts/intel/io/dktp/disk/cmdk.c
+++ b/usr/src/uts/intel/io/dktp/disk/cmdk.c
@@ -20,7 +20,7 @@
  */
 
 /*
- * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -1458,6 +1458,7 @@ cmdk_lb_rdwr(dev_info_t *dip, uchar_t cmd, void *bufaddr,
 	opaque_t	handle;
 	int		rc = 0;
 	char		*bufa;
+	size_t		buflen;
 
 	dkp = ddi_get_soft_state(cmdk_state, ddi_get_instance(dip));
 	if (dkp == NULL)
@@ -1466,9 +1467,9 @@ cmdk_lb_rdwr(dev_info_t *dip, uchar_t cmd, void *bufaddr,
 	if (cmd != TG_READ && cmd != TG_WRITE)
 		return (EINVAL);
 
-	/* count must be multiple of 512 */
-	count = (count + NBPSCTR - 1) & -NBPSCTR;
-	handle = dadk_iob_alloc(DKTP_DATA, start, count, KM_SLEEP);
+	/* buflen must be multiple of 512 */
+	buflen = (count + NBPSCTR - 1) & -NBPSCTR;
+	handle = dadk_iob_alloc(DKTP_DATA, start, buflen, KM_SLEEP);
 	if (!handle)
 		return (ENOMEM);