From owner-acpi-jp@jp.FreeBSD.org Sun Jan 11 09:58:23 2004
Received: (from daemon@localhost)
	by castle.jp.FreeBSD.org (8.11.6p2+3.4W/8.11.3) id i0B0wNo38891;
	Sun, 11 Jan 2004 09:58:23 +0900 (JST)
	(envelope-from owner-acpi-jp@jp.FreeBSD.org)
Received: from st68.arena.ne.jp (st68.arena.ne.jp [203.138.213.2])
	by castle.jp.FreeBSD.org (8.11.6p2+3.4W/8.11.3) with SMTP/inet id i0B0wMC38774
	for <acpi-jp@jp.FreeBSD.org>; Sun, 11 Jan 2004 09:58:22 +0900 (JST)
	(envelope-from aizu@navi.org)
Received: (qmail 25284 invoked by SAV 20040109.7); 11 Jan 2004 09:58:21 +0900
Received: from unknown (HELO localhost) (220.221.78.216)
  by st68.arena.ne.jp with SMTP; 11 Jan 2004 09:58:21 +0900
From: Hiroyuki Aizu <aizu@navi.org>
To: acpi-jp@jp.FreeBSD.org
Cc: nate@root.org
Message-Id: <20040111095906.22992322.aizu@navi.org>
In-Reply-To: <20040109105850.K40983@root.org>
References: <20040109105850.K40983@root.org>
Organization: navi.org
X-Mailer: Sylpheed version 0.9.5-gtk2-20030906 (GTK+ 2.2.4; i386-portbld-freebsd5.1)
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Reply-To: acpi-jp@jp.FreeBSD.org
Precedence: list
Date: Sun, 11 Jan 2004 09:59:06 +0900
X-Sequence: acpi-jp 2987
Subject: [acpi-jp 2987] Re: Revised Toshiba driver
Sender: owner-acpi-jp@jp.FreeBSD.org
X-Originator: aizu@navi.org
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+031216

Hi.

On Fri, 9 Jan 2004 11:00:05 -0800
Nate Lawson <nate@root.org> wrote:

> Please test this and let me know if you find any bugs.  Especially test
> things like the video output (TV/external monitory) since I'm not sure
> it's legal to have all 3 outputs active at once.

I found some problem in the function hci_*() etc.
( hci_force_fan(), hci_cpu_speed etc.)

These functions check the value range of 3rd argument.
For example in hci_force_fan().

-----------------------------------------------------
hci_force_fan(ACPI_HANDLE h, int op, UINT32 *state)
{
	int	ret;

	if (*state < 0 || (*state > 1)
		return (EINVAL)
-----------------------------------------------------

This function called by acpi_toshiba_sysctl(). The 3rd value is pointer of
"arg" in acpi_toshiba_sysctl(). The "arg" value is unsettled at first function
handler() [= hci_force_fan() etc.] called.
Therefore hci_force_fan() returns EINVAL at checking range of value. So these
function should be omit range check at HCI_GET like this.

-----------------------------------------------------
	if (op == HCI_SET) {
		if (*state < 0 || *state > 1)
			return (EINVAL);
		*state <<= 7;
	}
-----------------------------------------------------

I have not enough time to make patch and test now.
I'm sorry for about it.
Thanks.

Hiroyuki Aizu.
