⬢ DragonFlyBSD Kernel Audit
DF-1375 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
diff --git a/sys/dev/raid/mps/mps_mapping.c b/sys/dev/raid/mps/mps_mapping.c
--- a/sys/dev/raid/mps/mps_mapping.c
+++ b/sys/dev/raid/mps/mps_mapping.c
@@ -989,6 +989,14 @@
 					break;
 				}
 			}
+			if (map_idx >= sc->max_devices ||
+			    et_entry->num_slots > sc->max_devices ||
+			    map_idx + et_entry->num_slots > sc->max_devices) {
+				kprintf("%s: enclosure map_idx %d num_slots %d exceeds max "
+				    "devices %d, skipping.\n", __func__, map_idx,
+				    et_entry->num_slots, sc->max_devices);
+				continue;
+			}
 			mt_entry = &sc->mapping_table[map_idx];
 			for (index = map_idx; index < (et_entry->num_slots
 			    + map_idx); index++, mt_entry++) {
@@ -1162,8 +1170,19 @@
 				    __func__, phy_change->dev_handle);
 				continue;
 			}
+			if (phy_change->slot < et_entry->start_slot) {
+				kprintf("%s: device handle 0x%04x slot %d < start_slot %d, "
+				    "skipping.\n", __func__, phy_change->dev_handle,
+				    phy_change->slot, et_entry->start_slot);
+				continue;
+			}
 			map_idx = et_entry->start_index + phy_change->slot -
 			    et_entry->start_slot;
+			if (map_idx >= sc->max_devices) {
+				kprintf("%s: map_idx %d >= max_devices %d, skipping.\n",
+				    __func__, map_idx, sc->max_devices);
+				continue;
+			}
 			mt_entry = &sc->mapping_table[map_idx];
 			mt_entry->physical_id = phy_change->physical_id;
 			mt_entry->channel = 0;