DF-1290 / fix.diff
diff --git a/sys/dev/raid/mly/mly.c b/sys/dev/raid/mly/mly.c --- a/sys/dev/raid/mly/mly.c +++ b/sys/dev/raid/mly/mly.c @@ -1319,13 +1319,18 @@ switch(class) { case 'p': /* error on physical device */ mly_printf(sc, "physical device %d:%d %s\n", me->channel, me->target, tp); - if (action == 'r') + if (action == 'r' && me->channel < MLY_MAX_CHANNELS && + me->target < MLY_MAX_TARGETS) sc->mly_btl[me->channel][me->target].mb_flags |= MLY_BTL_RESCAN; break; case 'l': /* error on logical unit */ case 'm': /* message about logical unit */ bus = MLY_LOGDEV_BUS(sc, me->lun); target = MLY_LOGDEV_TARGET(sc, me->lun); + if (bus >= MLY_MAX_CHANNELS || target >= MLY_MAX_TARGETS) { + mly_printf(sc, "logical device %d bus/target out of range\n", me->lun); + break; + } mly_name_device(sc, bus, target); mly_printf(sc, "logical device %d (%s) %s\n", me->lun, sc->mly_btl[bus][target].mb_name, tp); if (action == 'r') @@ -1343,7 +1348,8 @@ ssd->flags & SSD_KEY, ssd->add_sense_code, ssd->add_sense_code_qual); mly_printf(sc, " info %s csi %s\n", hexncpy(ssd->info, 4, hexstr[0], 12, NULL), hexncpy(ssd->cmd_spec_info, 4, hexstr[1], 12, NULL)); - if (action == 'r') + if (action == 'r' && me->channel < MLY_MAX_CHANNELS && + me->target < MLY_MAX_TARGETS) sc->mly_btl[me->channel][me->target].mb_flags |= MLY_BTL_RESCAN; break; case 'e': |