DragonFlyBSD Kernel Audit
DF-2472 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/disk/isp/isp_freebsd.c b/sys/dev/disk/isp/isp_freebsd.c
--- a/sys/dev/disk/isp/isp_freebsd.c
+++ b/sys/dev/disk/isp/isp_freebsd.c
@@ -476,6 +476,10 @@
 		if (IS_SCSI(isp)) {
 			break;
 		}
+		if (ifc->chan < 0 || ifc->chan >= isp->isp_nchan) {
+			retval = EINVAL;
+			break;
+		}
 		if (ifc->loopid >= MAX_FC_TARG) {
 			retval = EINVAL;
 			break;