DF-2415 / fix.diff
diff --git a/sys/dev/disk/advansys/adwcam.c b/sys/dev/disk/advansys/adwcam.c --- a/sys/dev/disk/advansys/adwcam.c +++ b/sys/dev/disk/advansys/adwcam.c @@ -731,6 +731,20 @@ * get this information from the card. */ ccg = &ccb->ccg; + /* + * Guard against device-controlled block_size that would make the + * inner constant a multiple of, or larger than, block_size + * (zero quotient -> divide-by-zero on the outer division). The + * XPT core rejects block_size==0, but block_size > 1 MiB still + * drives the inner term to 0 here. + */ + if (ccg->block_size == 0 + || ccg->block_size > (1024L * 1024L) + || (1024L * 1024L) % ccg->block_size != 0) { + ccg->ccb_h.status = CAM_REQ_CMP_ERR; + xpt_done(ccb); + break; + } size_mb = ccg->volume_size / ((1024L * 1024L) / ccg->block_size); extended = 1; |