⬢ DragonFlyBSD Kernel Audit
DF-1283 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
diff --git a/sys/dev/raid/mpr/mpr_mapping.c b/sys/dev/raid/mpr/mpr_mapping.c
--- a/sys/dev/raid/mpr/mpr_mapping.c
+++ b/sys/dev/raid/mpr/mpr_mapping.c
@@ -1636,6 +1636,16 @@
 			 */
 			map_idx = et_entry->start_index + phy_change->slot -
 			    et_entry->start_slot;
+			if (phy_change->slot < et_entry->start_slot ||
+			    map_idx >= sc->max_devices) {
+				mpr_dprint(sc, MPR_ERROR | MPR_MAPPING, "%s: "
+				    "device handle 0x%04x slot %d/start_slot %d maps "
+				    "to bad idx %d (max %d), skipping.\n", __func__,
+				    phy_change->dev_handle, phy_change->slot,
+				    et_entry->start_slot, map_idx, sc->max_devices);
+				phy_change->is_processed = 1;
+				continue;
+			}
 			mt_entry = &sc->mapping_table[map_idx];
 			mt_entry->physical_id = phy_change->physical_id;
 			mt_entry->id = map_idx;
@@ -1893,6 +1903,16 @@
 			 */
 			map_idx = et_entry->start_index + port_change->slot -
 			    et_entry->start_slot;
+			if (port_change->slot < et_entry->start_slot ||
+			    map_idx >= sc->max_devices) {
+				mpr_dprint(sc, MPR_ERROR | MPR_MAPPING, "%s: "
+				    "device handle 0x%04x slot %d/start_slot %d maps "
+				    "to bad idx %d (max %d), skipping.\n", __func__,
+				    port_change->dev_handle, port_change->slot,
+				    et_entry->start_slot, map_idx, sc->max_devices);
+				port_change->is_processed = 1;
+				continue;
+			}
 			mt_entry = &sc->mapping_table[map_idx];
 			mt_entry->physical_id = port_change->physical_id;
 			mt_entry->id = map_idx;