diff --git a/sys/dev/raid/mps/mps_mapping.c b/sys/dev/raid/mps/mps_mapping.c --- a/sys/dev/raid/mps/mps_mapping.c +++ b/sys/dev/raid/mps/mps_mapping.c @@ -989,6 +989,14 @@ break; } } + if (map_idx >= sc->max_devices || + et_entry->num_slots > sc->max_devices || + map_idx + et_entry->num_slots > sc->max_devices) { + kprintf("%s: enclosure map_idx %d num_slots %d exceeds max " + "devices %d, skipping.\n", __func__, map_idx, + et_entry->num_slots, sc->max_devices); + continue; + } mt_entry = &sc->mapping_table[map_idx]; for (index = map_idx; index < (et_entry->num_slots + map_idx); index++, mt_entry++) { @@ -1162,8 +1170,19 @@ __func__, phy_change->dev_handle); continue; } + if (phy_change->slot < et_entry->start_slot) { + kprintf("%s: device handle 0x%04x slot %d < start_slot %d, " + "skipping.\n", __func__, phy_change->dev_handle, + phy_change->slot, et_entry->start_slot); + continue; + } map_idx = et_entry->start_index + phy_change->slot - et_entry->start_slot; + if (map_idx >= sc->max_devices) { + kprintf("%s: map_idx %d >= max_devices %d, skipping.\n", + __func__, map_idx, sc->max_devices); + continue; + } mt_entry = &sc->mapping_table[map_idx]; mt_entry->physical_id = phy_change->physical_id; mt_entry->channel = 0;