⬢ DragonFlyBSD Kernel Audit
DF-1258 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
diff --git a/sys/dev/raid/mfi/mfi.c b/sys/dev/raid/mfi/mfi.c
--- a/sys/dev/raid/mfi/mfi.c
+++ b/sys/dev/raid/mfi/mfi.c
@@ -2950,6 +2950,10 @@
 		ioc = (struct mfi_ioc_packet *)arg;
 		int adapter;
 
+		if (ioc->mfi_sge_count > MAX_IOCTL_SGE) {
+			error = EINVAL;
+			return (error);
+		}
 		adapter = ioc->mfi_adapter_no;
 		if (device_get_unit(sc->mfi_dev) == 0 && adapter != 0) {
 			devclass = devclass_find("mfi");
@@ -3015,6 +3019,12 @@
 				for (i = 0; i < ioc->mfi_sge_count; i++) {
 					addr = ioc->mfi_sgl[i].iov_base;
 					len = ioc->mfi_sgl[i].iov_len;
+					if ((size_t)(temp - data) + len > cm->cm_len) {
+						error = EINVAL;
+						device_printf(sc->mfi_dev,
+						    "SGE length exceeds data buffer\n");
+						goto out;
+					}
 					error = copyin(addr, temp, len);
 					if (error != 0) {
 						device_printf(sc->mfi_dev,
@@ -3064,6 +3074,12 @@
 				for (i = 0; i < ioc->mfi_sge_count; i++) {
 					addr = ioc->mfi_sgl[i].iov_base;
 					len = ioc->mfi_sgl[i].iov_len;
+					if ((size_t)(temp - data) + len > cm->cm_len) {
+						error = EINVAL;
+						device_printf(sc->mfi_dev,
+						    "SGE length exceeds data buffer\n");
+						goto out;
+					}
 					error = copyout(temp, addr, len);
 					if (error != 0) {
 						device_printf(sc->mfi_dev,
@@ -3251,6 +3267,13 @@
 		temp = data;
 		if (cm->cm_flags & MFI_CMD_DATAOUT) {
 			for (i = 0; i < l_ioc.lioc_sge_count; i++) {
+				if ((size_t)(temp - data) +
+					    l_ioc.lioc_sgl[i].iov_len > cm->cm_len) {
+					error = EINVAL;
+					device_printf(sc->mfi_dev,
+					    "SGE length exceeds data buffer\n");
+					goto out;
+				}
 				error = copyin(PTRIN(l_ioc.lioc_sgl[i].iov_base),
 				       temp,
 				       l_ioc.lioc_sgl[i].iov_len);
@@ -3293,6 +3316,13 @@
 		temp = data;
 		if (cm->cm_flags & MFI_CMD_DATAIN) {
 			for (i = 0; i < l_ioc.lioc_sge_count; i++) {
+				if ((size_t)(temp - data) +
+					    l_ioc.lioc_sgl[i].iov_len > cm->cm_len) {
+					error = EINVAL;
+					device_printf(sc->mfi_dev,
+					    "SGE length exceeds data buffer\n");
+					goto out;
+				}
 				error = copyout(temp,
 					PTRIN(l_ioc.lioc_sgl[i].iov_base),
 					l_ioc.lioc_sgl[i].iov_len);