⬢ DragonFlyBSD Kernel Audit
DF-1449 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
diff --git a/sys/dev/disk/mpt/mpt_raid.c b/sys/dev/disk/mpt/mpt_raid.c
--- a/sys/dev/disk/mpt/mpt_raid.c
+++ b/sys/dev/disk/mpt/mpt_raid.c
@@ -410,7 +410,8 @@
 	}
 
 	mpt_disk = NULL;
-	if (raid_event->PhysDiskNum != 0xFF && mpt->raid_disks != NULL) {
+	if (raid_event->PhysDiskNum != 0xFF && mpt->raid_disks != NULL &&
+	    raid_event->PhysDiskNum < mpt->raid_max_disks) {
 		mpt_disk = mpt->raid_disks + raid_event->PhysDiskNum;
 		if ((mpt_disk->flags & MPT_RDF_ACTIVE) == 0) {
 			mpt_disk = NULL;
@@ -1152,6 +1153,11 @@
 		int pt_bus = cam_sim_bus(mpt->phydisk_sim);
 		U8 f, s;
 
+		if (vol_pg->PhysDisk[i].PhysDiskNum >= mpt->raid_max_disks) {
+			mpt_vol_prt(mpt, mpt_vol, "  PhysDiskNum %u out of range\n",
+				    vol_pg->PhysDisk[i].PhysDiskNum);
+			continue;
+		}
 		mpt_disk = mpt->raid_disks + vol_pg->PhysDisk[i].PhysDiskNum;
 		disk_pg = &mpt_disk->config_page;
 		mpt_prtc(mpt, "      ");
@@ -1306,6 +1312,12 @@
 	/* Update disk entry array data. */
 	for (i = 0; i < vol_pg->NumPhysDisks; i++) {
 		struct mpt_raid_disk *mpt_disk;
+		if (vol_pg->PhysDisk[i].PhysDiskNum >= mpt->raid_max_disks) {
+			mpt_vol_prt(mpt, mpt_vol,
+			    "PhysDiskNum %u out of range\n",
+			    vol_pg->PhysDisk[i].PhysDiskNum);
+			continue;
+		}
 		mpt_disk = mpt->raid_disks + vol_pg->PhysDisk[i].PhysDiskNum;
 		mpt_disk->volume = mpt_vol;
 		mpt_disk->member_number = vol_pg->PhysDisk[i].PhysDiskMap;
@@ -1402,6 +1414,11 @@
 	for (; ioc_disk != ioc_last_disk; ioc_disk++) {
 		struct mpt_raid_disk *mpt_disk;
 
+		if (ioc_disk->PhysDiskNum >= mpt->raid_max_disks) {
+			mpt_prt(mpt, "IOC3 PhysDiskNum %u out of range\n",
+				ioc_disk->PhysDiskNum);
+			continue;
+		}
 		mpt_disk = mpt->raid_disks + ioc_disk->PhysDiskNum;
 		mpt_disk->flags |= MPT_RDF_REFERENCED;
 		if ((mpt_disk->flags & (MPT_RDF_ACTIVE|MPT_RDF_UP2DATE))
@@ -1433,6 +1450,11 @@
 	for (;ioc_vol != ioc_last_vol; ioc_vol++) {
 		struct mpt_raid_volume *mpt_vol;
 
+		if (ioc_vol->VolumePageNumber >= mpt->raid_max_volumes) {
+			mpt_prt(mpt, "IOC2 VolumePageNumber %u out of range\n",
+				ioc_vol->VolumePageNumber);
+			continue;
+		}
 		mpt_vol = mpt->raid_volumes + ioc_vol->VolumePageNumber;
 		mpt_vol->flags |= MPT_RVF_REFERENCED;
 		vol_pg = mpt_vol->config_page;