⬢ DragonFlyBSD Kernel Audit
DF-1173 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
diff --git a/sys/dev/disk/nata/ata-raid.c b/sys/dev/disk/nata/ata-raid.c
--- a/sys/dev/disk/nata/ata-raid.c
+++ b/sys/dev/disk/nata/ata-raid.c
@@ -1858,6 +1858,10 @@
 	}
 
 	raid->format |= AR_F_HPTV2_RAID;
+	if (disk_number >= MAX_DISKS) {
+	    device_printf(parent, "Highpoint (v2) metadata disk_number %d out of range\n", disk_number);
+	    goto hptv2_out;
+	}
 	raid->disks[disk_number].dev = parent;
 	raid->disks[disk_number].flags = (AR_DF_PRESENT | AR_DF_ASSIGNED);
 	raid->lun = array;
@@ -2100,6 +2104,10 @@
 	raid->lun = array;
 	strncpy(raid->name, meta->name,
 		min(sizeof(raid->name), sizeof(meta->name)));
+	if (disk_number >= MAX_DISKS) {
+	    device_printf(parent, "Highpoint (v3) metadata disk_number %d out of range\n", disk_number);
+	    goto hptv3_out;
+	}
 	raid->disks[disk_number].sectors = raid->total_sectors /
 	    (raid->type == AR_T_RAID5 ? raid->width - 1 : raid->width);
 	raid->disks[disk_number].dev = parent;
@@ -2863,6 +2871,10 @@
 	raid->lun = array;
 
 	if (meta->configs[conf_entry].disk.device != LSIV2_D_NONE) {
+	    if (meta->disk_number >= MAX_DISKS) {
+		device_printf(parent, "LSI (v2) metadata disk_number %d out of range\n", meta->disk_number);
+		goto lsiv2_out;
+	    }
 	    raid->disks[meta->disk_number].dev = parent;
 	    raid->disks[meta->disk_number].sectors = 
 		meta->configs[conf_entry].disk.disk_sectors;
@@ -3118,6 +3130,10 @@
 	if (meta->status & NV_S_DEGRADED)
 	    raid->status |= AR_S_DEGRADED;
 
+	if (meta->disk_number >= MAX_DISKS) {
+	    device_printf(parent, "nVidia metadata disk_number %d out of range\n", meta->disk_number);
+	    goto nvidia_out;
+	}
 	raid->disks[meta->disk_number].dev = parent;
 	raid->disks[meta->disk_number].sectors =
 	    raid->total_sectors / raid->width;
@@ -3588,6 +3604,10 @@
 		int disk_number = (raid->type == AR_T_RAID01) ?
 		    meta->raid1_ident + (meta->raid0_ident << 1) :
 		    meta->disk_number;
+		if (disk_number >= MAX_DISKS) {
+		    device_printf(parent, "SiI metadata disk_number %d out of range\n", disk_number);
+		    goto sii_out;
+		}
 
 		raid->disks[disk_number].dev = parent;
 		raid->disks[disk_number].sectors =