Fix read past end of struct in ncsw glue code.

The logic in XX_IsPortalIntr() was reading past the end of XX_PInfo.
This was causing it to erroneously return 1 instead of 0 in some
circumstances, causing a panic on the AmigaOne X5000 due to mixing
exclusive and nonexclusive interrupts on the same interrupt line.

Since this code is only called a couple of times during startup, use
a simple double loop instead of the complex read-ahead single loop.

This also fixes a bug where it would never check cpu=0 on type=1.

Approved by: jhibbits (mentor)
Differential Revision: https://reviews.freebsd.org/D21988

1 files changed, 4 insertions, 10 deletions

diff --git a/sys/contrib/ncsw/user/env/xx.c b/sys/contrib/ncsw/user/env/xx.c
index 2a0c59ed10e3..4cf78d52f9eb 100644
--- a/sys/contrib/ncsw/user/env/xx.c
+++ b/sys/contrib/ncsw/user/env/xx.c
@@ -288,16 +288,10 @@ XX_IsPortalIntr(uintptr_t irq)
 {
 	int cpu, type;
 	/* Check interrupt numbers of all available portals */
-	for (cpu = 0, type = 0; XX_PInfo.portal_intr[type][cpu] != 0; cpu++) {
-		if (irq == XX_PInfo.portal_intr[type][cpu]) {
-			/* Found it! */
-			return (1);
-		}
-		if (XX_PInfo.portal_intr[type][cpu + 1] == 0) {
-			type++;
-			cpu = 0;
-		}
-	}
+	for (type = 0; type < 2; type++)
+		for (cpu = 0; cpu < MAXCPU; cpu++)
+			if (irq == XX_PInfo.portal_intr[type][cpu])
+				return (1);
 
 	return (0);
 }