DragonFlyBSD Kernel Audit
DF-1290 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/raid/mly/mly.c b/sys/dev/raid/mly/mly.c
--- a/sys/dev/raid/mly/mly.c
+++ b/sys/dev/raid/mly/mly.c
@@ -1319,13 +1319,18 @@
     switch(class) {
     case 'p':		/* error on physical device */
 	mly_printf(sc, "physical device %d:%d %s\n", me->channel, me->target, tp);
-	if (action == 'r')
+	if (action == 'r' && me->channel < MLY_MAX_CHANNELS &&
+	    me->target < MLY_MAX_TARGETS)
 	    sc->mly_btl[me->channel][me->target].mb_flags |= MLY_BTL_RESCAN;
 	break;
     case 'l':		/* error on logical unit */
     case 'm':		/* message about logical unit */
 	bus = MLY_LOGDEV_BUS(sc, me->lun);
 	target = MLY_LOGDEV_TARGET(sc, me->lun);
+	if (bus >= MLY_MAX_CHANNELS || target >= MLY_MAX_TARGETS) {
+	    mly_printf(sc, "logical device %d bus/target out of range\n", me->lun);
+	    break;
+	}
 	mly_name_device(sc, bus, target);
 	mly_printf(sc, "logical device %d (%s) %s\n", me->lun, sc->mly_btl[bus][target].mb_name, tp);
 	if (action == 'r')
@@ -1343,7 +1348,8 @@
 		      ssd->flags & SSD_KEY, ssd->add_sense_code, ssd->add_sense_code_qual);
 	mly_printf(sc, "  info %s csi %s\n", hexncpy(ssd->info, 4, hexstr[0], 12, NULL),
 	    hexncpy(ssd->cmd_spec_info, 4, hexstr[1], 12, NULL));
-	if (action == 'r')
+	if (action == 'r' && me->channel < MLY_MAX_CHANNELS &&
+	    me->target < MLY_MAX_TARGETS)
 	    sc->mly_btl[me->channel][me->target].mb_flags |= MLY_BTL_RESCAN;
 	break;
     case 'e':