DragonFlyBSD Kernel Audit
DF-2415 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/disk/advansys/adwcam.c b/sys/dev/disk/advansys/adwcam.c
--- a/sys/dev/disk/advansys/adwcam.c
+++ b/sys/dev/disk/advansys/adwcam.c
@@ -731,6 +731,20 @@
 		 *     get this information from the card.
 		 */
 		ccg = &ccb->ccg;
+		/*
+		 * Guard against device-controlled block_size that would make the
+		 * inner constant a multiple of, or larger than, block_size
+		 * (zero quotient -> divide-by-zero on the outer division).  The
+		 * XPT core rejects block_size==0, but block_size > 1 MiB still
+		 * drives the inner term to 0 here.
+		 */
+		if (ccg->block_size == 0
+		 || ccg->block_size > (1024L * 1024L)
+		 || (1024L * 1024L) % ccg->block_size != 0) {
+			ccg->ccb_h.status = CAM_REQ_CMP_ERR;
+			xpt_done(ccb);
+			break;
+		}
 		size_mb = ccg->volume_size
 			/ ((1024L * 1024L) / ccg->block_size);
 		extended = 1;