⬢ DragonFlyBSD Kernel Audit
DF-1428 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
diff --git a/sys/dev/raid/twe/twe.c b/sys/dev/raid/twe/twe.c
--- a/sys/dev/raid/twe/twe.c
+++ b/sys/dev/raid/twe/twe.c
@@ -1689,6 +1689,10 @@
     /* print attached drives */
     if (bootverbose) {
 	p[0] = twe_get_param(sc, TWE_PARAM_DRIVESUMMARY, TWE_PARAM_DRIVESUMMARY_Status, 16, NULL);
+	if (p[0] == NULL) {
+	    TWE_IO_UNLOCK(sc);
+	    return;
+	}
 	for (i = 0; i < ports; i++) {
 	    if (p[0]->data[i] != TWE_PARAM_DRIVESTATUS_Present)
 		continue;
@@ -1805,7 +1809,8 @@
 	return(msg);
 
     case 'c':
-	if ((child = sc->twe_drive[TWE_AEN_UNIT(aen)].td_disk) != NULL) {
+	if (TWE_AEN_UNIT(aen) < nitems(sc->twe_drive) &&
+	    (child = sc->twe_drive[TWE_AEN_UNIT(aen)].td_disk) != NULL) {
 	    ksnprintf(sc->twe_aen_buf, sizeof(sc->twe_aen_buf), "twed%d: %s",
 		device_get_unit(child), msg);
 	} else {
@@ -1859,15 +1864,15 @@
 	 */
 	switch (cmd->generic.flags) {
 	case 0x1b:
-	    device_printf(sc->twe_drive[cmd->generic.unit].td_disk,
+	    if (cmd->generic.unit < nitems(sc->twe_drive) && sc->twe_drive[cmd->generic.unit].td_disk) device_printf(sc->twe_drive[cmd->generic.unit].td_disk,
 			  "drive timeout\n");
 	    break;
 	case 0x51:
-	    device_printf(sc->twe_drive[cmd->generic.unit].td_disk,
+	    if (cmd->generic.unit < nitems(sc->twe_drive) && sc->twe_drive[cmd->generic.unit].td_disk) device_printf(sc->twe_drive[cmd->generic.unit].td_disk,
 			  "unrecoverable drive error\n");
 	    break;
 	default:
-	    device_printf(sc->twe_drive[cmd->generic.unit].td_disk,
+	    if (cmd->generic.unit < nitems(sc->twe_drive) && sc->twe_drive[cmd->generic.unit].td_disk) device_printf(sc->twe_drive[cmd->generic.unit].td_disk,
 			  "controller error - %s (flags = 0x%x)\n",
 			  twe_describe_code(twe_table_status, cmd->generic.status),
 			  cmd->generic.flags);
@@ -1877,7 +1882,7 @@
 	/*
 	 * Warning level status.
 	 */
-	device_printf(sc->twe_drive[cmd->generic.unit].td_disk,
+	if (cmd->generic.unit < nitems(sc->twe_drive) && sc->twe_drive[cmd->generic.unit].td_disk) device_printf(sc->twe_drive[cmd->generic.unit].td_disk,
 		      "warning - %s (flags = 0x%x)\n",
 		      twe_describe_code(twe_table_status, cmd->generic.status),
 		      cmd->generic.flags);
@@ -1885,7 +1890,7 @@
 	/*
 	 * Info level status.
 	 */
-	device_printf(sc->twe_drive[cmd->generic.unit].td_disk,
+	if (cmd->generic.unit < nitems(sc->twe_drive) && sc->twe_drive[cmd->generic.unit].td_disk) device_printf(sc->twe_drive[cmd->generic.unit].td_disk,
 		      "attention - %s (flags = 0x%x)\n",
 		      twe_describe_code(twe_table_status, cmd->generic.status),
 		      cmd->generic.flags);