⬢ DragonFlyBSD Kernel Audit
DF-1228 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
diff --git a/sys/dev/raid/mpr/mpr.c b/sys/dev/raid/mpr/mpr.c
--- a/sys/dev/raid/mpr/mpr.c
+++ b/sys/dev/raid/mpr/mpr.c
@@ -2333,6 +2333,12 @@
 		case MPI2_RPY_DESCRIPT_FLAGS_SCSI_IO_SUCCESS:
 		case MPI25_RPY_DESCRIPT_FLAGS_FAST_PATH_SCSI_IO_SUCCESS:
 		case MPI26_RPY_DESCRIPT_FLAGS_PCIE_ENCAPSULATED_SUCCESS:
+			if (le16toh(desc->SCSIIOSuccess.SMID) == 0 ||
+			    le16toh(desc->SCSIIOSuccess.SMID) >= sc->num_reqs) {
+				mpr_dprint(sc, MPR_ERROR, "Invalid SCSIIOSuccess SMID %u\n",
+				    le16toh(desc->SCSIIOSuccess.SMID));
+				break;
+			}
 			cm = &sc->commands[le16toh(desc->SCSIIOSuccess.SMID)];
 			KASSERT(cm->cm_state == MPR_CM_STATE_INQUEUE,
 			    ("command not inqueue\n"));
@@ -2404,6 +2410,13 @@
 					    (MPI2_EVENT_NOTIFICATION_REPLY *)
 					    reply);
 			} else {
+				if (le16toh(desc->AddressReply.SMID) == 0 ||
+				    le16toh(desc->AddressReply.SMID) >= sc->num_reqs) {
+					mpr_dprint(sc, MPR_ERROR,
+					    "Invalid AddressReply SMID %u\n",
+					    le16toh(desc->AddressReply.SMID));
+					break;
+				}
 				cm = &sc->commands[
 				    le16toh(desc->AddressReply.SMID)];
 				KASSERT(cm->cm_state == MPR_CM_STATE_INQUEUE,