DragonFlyBSD Kernel Audit
DF-1284 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/raid/hptmv/entry.c b/sys/dev/raid/hptmv/entry.c
--- a/sys/dev/raid/hptmv/entry.c
+++ b/sys/dev/raid/hptmv/entry.c
@@ -2856,6 +2856,18 @@
 				if (ccb->ccb_h.flags & CAM_SG_LIST_PHYS)
 					pCmd->cf_physical_sg = 1;
 
+				if (ccb->csio.sglist_cnt > MAX_SG_DESCRIPTORS) {
+					hpt_printk(("%s: sglist_cnt %d exceeds MAX_SG_DESCRIPTORS "
+					    "%d, rejecting.\n", __func__, ccb->csio.sglist_cnt,
+					    MAX_SG_DESCRIPTORS));
+					FreeCommand(_VBUS_P pCmd);
+					ccb->ccb_h.status = CAM_REQ_TOO_BIG;
+					dmamap_put(pmap);
+					pAdapter->outstandingCommands--;
+					xpt_done(ccb);
+					goto Command_Complished;
+				}
+
 				for (idx = 0; idx < ccb->csio.sglist_cnt; idx++) {
 					pCmd->pSgTable[idx].dSgAddress = (ULONG_PTR)(UCHAR *)sgList[idx].ds_addr;
 					pCmd->pSgTable[idx].wSgSize = sgList[idx].ds_len;