DF-1284 / fix.diff
diff --git a/sys/dev/raid/hptmv/entry.c b/sys/dev/raid/hptmv/entry.c --- a/sys/dev/raid/hptmv/entry.c +++ b/sys/dev/raid/hptmv/entry.c @@ -2856,6 +2856,18 @@ if (ccb->ccb_h.flags & CAM_SG_LIST_PHYS) pCmd->cf_physical_sg = 1; + if (ccb->csio.sglist_cnt > MAX_SG_DESCRIPTORS) { + hpt_printk(("%s: sglist_cnt %d exceeds MAX_SG_DESCRIPTORS " + "%d, rejecting.\n", __func__, ccb->csio.sglist_cnt, + MAX_SG_DESCRIPTORS)); + FreeCommand(_VBUS_P pCmd); + ccb->ccb_h.status = CAM_REQ_TOO_BIG; + dmamap_put(pmap); + pAdapter->outstandingCommands--; + xpt_done(ccb); + goto Command_Complished; + } + for (idx = 0; idx < ccb->csio.sglist_cnt; idx++) { pCmd->pSgTable[idx].dSgAddress = (ULONG_PTR)(UCHAR *)sgList[idx].ds_addr; pCmd->pSgTable[idx].wSgSize = sgList[idx].ds_len; |