DF-2518 / fix.diff
diff --git a/sys/dev/disk/sili/sili.c b/sys/dev/disk/sili/sili.c --- a/sys/dev/disk/sili/sili.c +++ b/sys/dev/disk/sili/sili.c @@ -2137,6 +2137,11 @@ */ err_slot = log->err_regs.type & ATA_LOG_10H_TYPE_TAG_MASK; + if (err_slot >= sc->sc_ncmds) { + kprintf("%s: NCQ error page has invalid tag %d\n", + PORTNAME(ap), err_slot); + break; + } ccb = &ap->ap_ccbs[err_slot]; if (ap->ap_expired & (1 << ccb->ccb_slot)) { kprintf("%s: read NCQ error page slot=%d\n", |